Frame 1 (118 bytes on wire, 118 bytes captured) Arrival Time: Oct 26, 2009 14:16:27.206020000 [Time delta from previous captured frame: 0.000000000 seconds] [Time delta from previous displayed frame: 0.000000000 seconds] [Time since reference or first frame: 0.000000000 seconds] Frame Number: 1 Frame Length: 118 bytes Capture Length: 118 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f), Dst: 00:13:19:ca:ce:30 (00:13:19:ca:ce:30) Destination: 00:13:19:ca:ce:30 (00:13:19:ca:ce:30) Address: 00:13:19:ca:ce:30 (00:13:19:ca:ce:30) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) Address: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.124 (165.227.249.124), Dst: 165.227.249.118 (165.227.249.118) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 104 Identification: 0x0000 (0) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfbca [correct] [Good: True] [Bad : False] Source: 165.227.249.124 (165.227.249.124) Destination: 165.227.249.118 (165.227.249.118) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 84 Checksum: 0x68ca [correct] [Good Checksum: True] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: D02A09D7064888F2 Responder cookie: D819AE9FA6032E98 Next payload: Hash (8) Version: 1.0 Exchange type: Informational (5) Flags: 0x01 .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0xbbbaf498 Length: 76 Encrypted payload (48 bytes) 0000 00 13 19 ca ce 30 00 0c 29 48 f8 2f 08 00 45 00 .....0..)H./..E. 0010 00 68 00 00 40 00 40 11 fb ca a5 e3 f9 7c a5 e3 .h..@.@......|.. 0020 f9 76 01 f4 01 f4 00 54 68 ca d0 2a 09 d7 06 48 .v.....Th..*...H 0030 88 f2 d8 19 ae 9f a6 03 2e 98 08 10 05 01 bb ba ................ 0040 f4 98 00 00 00 4c f8 59 28 c6 4d 83 a1 3b c1 9d .....L.Y(.M..;.. 0050 ed 99 04 77 2b 18 82 fe ac 59 f5 37 6b 02 78 f6 ...w+....Y.7k.x. 0060 0b 81 3b 83 3c c4 81 af 5a 74 69 f1 23 d4 26 d0 ..;.<...Zti.#.&. 0070 df d7 ba e9 2b 24 ....+$ Frame 2 (118 bytes on wire, 118 bytes captured) Arrival Time: Oct 26, 2009 14:16:27.206030000 [Time delta from previous captured frame: 0.000010000 seconds] [Time delta from previous displayed frame: 0.000010000 seconds] [Time since reference or first frame: 0.000010000 seconds] Frame Number: 2 Frame Length: 118 bytes Capture Length: 118 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f), Dst: 00:13:19:ca:ce:30 (00:13:19:ca:ce:30) Destination: 00:13:19:ca:ce:30 (00:13:19:ca:ce:30) Address: 00:13:19:ca:ce:30 (00:13:19:ca:ce:30) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) Address: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.124 (165.227.249.124), Dst: 165.227.249.118 (165.227.249.118) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 104 Identification: 0x0000 (0) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfbca [correct] [Good: True] [Bad : False] Source: 165.227.249.124 (165.227.249.124) Destination: 165.227.249.118 (165.227.249.118) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 84 Checksum: 0x68ca [correct] [Good Checksum: True] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: D02A09D7064888F2 Responder cookie: D819AE9FA6032E98 Next payload: Hash (8) Version: 1.0 Exchange type: Informational (5) Flags: 0x01 .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0xbbbaf498 Length: 76 Encrypted payload (48 bytes) 0000 00 13 19 ca ce 30 00 0c 29 48 f8 2f 08 00 45 00 .....0..)H./..E. 0010 00 68 00 00 40 00 40 11 fb ca a5 e3 f9 7c a5 e3 .h..@.@......|.. 0020 f9 76 01 f4 01 f4 00 54 68 ca d0 2a 09 d7 06 48 .v.....Th..*...H 0030 88 f2 d8 19 ae 9f a6 03 2e 98 08 10 05 01 bb ba ................ 0040 f4 98 00 00 00 4c f8 59 28 c6 4d 83 a1 3b c1 9d .....L.Y(.M..;.. 0050 ed 99 04 77 2b 18 82 fe ac 59 f5 37 6b 02 78 f6 ...w+....Y.7k.x. 0060 0b 81 3b 83 3c c4 81 af 5a 74 69 f1 23 d4 26 d0 ..;.<...Zti.#.&. 0070 df d7 ba e9 2b 24 ....+$ Frame 3 (134 bytes on wire, 134 bytes captured) Arrival Time: Oct 26, 2009 14:16:27.206232000 [Time delta from previous captured frame: 0.000202000 seconds] [Time delta from previous displayed frame: 0.000202000 seconds] [Time since reference or first frame: 0.000212000 seconds] Frame Number: 3 Frame Length: 134 bytes Capture Length: 134 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f), Dst: 00:13:19:ca:ce:30 (00:13:19:ca:ce:30) Destination: 00:13:19:ca:ce:30 (00:13:19:ca:ce:30) Address: 00:13:19:ca:ce:30 (00:13:19:ca:ce:30) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) Address: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.124 (165.227.249.124), Dst: 165.227.249.118 (165.227.249.118) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 120 Identification: 0x0000 (0) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfbba [correct] [Good: True] [Bad : False] Source: 165.227.249.124 (165.227.249.124) Destination: 165.227.249.118 (165.227.249.118) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 100 Checksum: 0x6a4a [correct] [Good Checksum: True] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: D02A09D7064888F2 Responder cookie: D819AE9FA6032E98 Next payload: Hash (8) Version: 1.0 Exchange type: Informational (5) Flags: 0x01 .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0xc5e72363 Length: 92 Encrypted payload (64 bytes) 0000 00 13 19 ca ce 30 00 0c 29 48 f8 2f 08 00 45 00 .....0..)H./..E. 0010 00 78 00 00 40 00 40 11 fb ba a5 e3 f9 7c a5 e3 .x..@.@......|.. 0020 f9 76 01 f4 01 f4 00 64 6a 4a d0 2a 09 d7 06 48 .v.....djJ.*...H 0030 88 f2 d8 19 ae 9f a6 03 2e 98 08 10 05 01 c5 e7 ................ 0040 23 63 00 00 00 5c ad 67 68 ad 2f c8 b4 a6 0f 2b #c...\.gh./....+ 0050 5a 09 93 56 e3 6f 86 88 a2 17 8e 89 11 05 f9 b4 Z..V.o.......... 0060 a1 3b ae 05 4a ab 4e 5c b1 51 0d e1 ea 28 78 51 .;..J.N\.Q...(xQ 0070 95 43 b0 6c a8 13 11 ed 97 2f e4 bb ba b6 4e 62 .C.l...../....Nb 0080 48 c1 a9 66 79 b9 H..fy. Frame 4 (134 bytes on wire, 134 bytes captured) Arrival Time: Oct 26, 2009 14:16:27.206242000 [Time delta from previous captured frame: 0.000010000 seconds] [Time delta from previous displayed frame: 0.000010000 seconds] [Time since reference or first frame: 0.000222000 seconds] Frame Number: 4 Frame Length: 134 bytes Capture Length: 134 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f), Dst: 00:13:19:ca:ce:30 (00:13:19:ca:ce:30) Destination: 00:13:19:ca:ce:30 (00:13:19:ca:ce:30) Address: 00:13:19:ca:ce:30 (00:13:19:ca:ce:30) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) Address: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.124 (165.227.249.124), Dst: 165.227.249.118 (165.227.249.118) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 120 Identification: 0x0000 (0) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfbba [correct] [Good: True] [Bad : False] Source: 165.227.249.124 (165.227.249.124) Destination: 165.227.249.118 (165.227.249.118) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 100 Checksum: 0x6a4a [correct] [Good Checksum: True] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: D02A09D7064888F2 Responder cookie: D819AE9FA6032E98 Next payload: Hash (8) Version: 1.0 Exchange type: Informational (5) Flags: 0x01 .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0xc5e72363 Length: 92 Encrypted payload (64 bytes) 0000 00 13 19 ca ce 30 00 0c 29 48 f8 2f 08 00 45 00 .....0..)H./..E. 0010 00 78 00 00 40 00 40 11 fb ba a5 e3 f9 7c a5 e3 .x..@.@......|.. 0020 f9 76 01 f4 01 f4 00 64 6a 4a d0 2a 09 d7 06 48 .v.....djJ.*...H 0030 88 f2 d8 19 ae 9f a6 03 2e 98 08 10 05 01 c5 e7 ................ 0040 23 63 00 00 00 5c ad 67 68 ad 2f c8 b4 a6 0f 2b #c...\.gh./....+ 0050 5a 09 93 56 e3 6f 86 88 a2 17 8e 89 11 05 f9 b4 Z..V.o.......... 0060 a1 3b ae 05 4a ab 4e 5c b1 51 0d e1 ea 28 78 51 .;..J.N\.Q...(xQ 0070 95 43 b0 6c a8 13 11 ed 97 2f e4 bb ba b6 4e 62 .C.l...../....Nb 0080 48 c1 a9 66 79 b9 H..fy. Frame 5 (250 bytes on wire, 250 bytes captured) Arrival Time: Oct 26, 2009 14:16:44.034461000 [Time delta from previous captured frame: 16.828219000 seconds] [Time delta from previous displayed frame: 16.828219000 seconds] [Time since reference or first frame: 16.828441000 seconds] Frame Number: 5 Frame Length: 250 bytes Capture Length: 250 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f), Dst: 00:09:5b:2b:a8:d7 (00:09:5b:2b:a8:d7) Destination: 00:09:5b:2b:a8:d7 (00:09:5b:2b:a8:d7) Address: 00:09:5b:2b:a8:d7 (00:09:5b:2b:a8:d7) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) Address: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.124 (165.227.249.124), Dst: 165.227.249.125 (165.227.249.125) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 236 Identification: 0x0000 (0) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfb3f [correct] [Good: True] [Bad : False] Source: 165.227.249.124 (165.227.249.124) Destination: 165.227.249.125 (165.227.249.125) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 216 Checksum: 0x6785 [correct] [Good Checksum: True] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: 421633A1B8275EF1 Responder cookie: 0000000000000000 Next payload: Security Association (1) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags: 0x00 .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 208 Security Association payload Next payload: Vendor ID (13) Payload length: 60 Domain of interpretation: IPSEC (1) Situation: IDENTITY (1) Proposal payload # 0 Next payload: NONE (0) Payload length: 48 Proposal number: 0 Protocol ID: ISAKMP (1) SPI Size: 8 Proposal transforms: 1 SPI: 0x421633A1B8275EF1 Transform payload # 0 Next payload: NONE (0) Payload length: 32 Transform number: 0 Transform ID: KEY_IKE (1) Encryption-Algorithm (1): 3DES-CBC (5) Hash-Algorithm (2): SHA (2) Authentication-Method (3): PSK (1) Group-Description (4): Alternate 1024-bit MODP group (2) Life-Type (11): Seconds (1) Life-Duration (12): Duration-Value (28800) Vendor ID: F758F22668750F03B08DF6EBE1D00500 Next payload: Vendor ID (13) Payload length: 20 Vendor ID: F758F22668750F03B08DF6EBE1D00500 Vendor ID: draft-ietf-ipsec-nat-t-ike-02 Next payload: Vendor ID (13) Payload length: 20 Vendor ID: draft-ietf-ipsec-nat-t-ike-02 Vendor ID: draft-ietf-ipsec-nat-t-ike-02\n Next payload: Vendor ID (13) Payload length: 20 Vendor ID: draft-ietf-ipsec-nat-t-ike-02\n Vendor ID: draft-ietf-ipsec-nat-t-ike-03 Next payload: Vendor ID (13) Payload length: 20 Vendor ID: draft-ietf-ipsec-nat-t-ike-03 Vendor ID: RFC 3947 Negotiation of NAT-Traversal in the IKE Next payload: Vendor ID (13) Payload length: 20 Vendor ID: RFC 3947 Negotiation of NAT-Traversal in the IKE Vendor ID: RFC 3706 Detecting Dead IKE Peers (DPD) Next payload: NONE (0) Payload length: 20 Vendor ID: RFC 3706 Detecting Dead IKE Peers (DPD) 0000 00 09 5b 2b a8 d7 00 0c 29 48 f8 2f 08 00 45 00 ..[+....)H./..E. 0010 00 ec 00 00 40 00 40 11 fb 3f a5 e3 f9 7c a5 e3 ....@.@..?...|.. 0020 f9 7d 01 f4 01 f4 00 d8 67 85 42 16 33 a1 b8 27 .}......g.B.3..' 0030 5e f1 00 00 00 00 00 00 00 00 01 10 02 00 00 00 ^............... 0040 00 00 00 00 00 d0 0d 00 00 3c 00 00 00 01 00 00 .........<...... 0050 00 01 00 00 00 30 00 01 08 01 42 16 33 a1 b8 27 .....0....B.3..' 0060 5e f1 00 00 00 20 00 01 00 00 80 01 00 05 80 02 ^.... .......... 0070 00 02 80 03 00 01 80 04 00 02 80 0b 00 01 80 0c ................ 0080 70 80 0d 00 00 14 f7 58 f2 26 68 75 0f 03 b0 8d p......X.&hu.... 0090 f6 eb e1 d0 05 00 0d 00 00 14 cd 60 46 43 35 df ...........`FC5. 00a0 21 f8 7c fd b2 fc 68 b6 a4 48 0d 00 00 14 90 cb !.|...h..H...... 00b0 80 91 3e bb 69 6e 08 63 81 b5 ec 42 7b 1f 0d 00 ..>.in.c...B{... 00c0 00 14 7d 94 19 a6 53 10 ca 6f 2c 17 9d 92 15 52 ..}...S..o,....R 00d0 9d 56 0d 00 00 14 4a 13 1c 81 07 03 58 45 5c 57 .V....J.....XE\W 00e0 28 f2 0e 95 45 2f 00 00 00 14 af ca d7 13 68 a1 (...E/........h. 00f0 f1 c9 6b 86 96 fc 77 57 01 00 ..k...wW.. Frame 6 (250 bytes on wire, 250 bytes captured) Arrival Time: Oct 26, 2009 14:16:44.034473000 [Time delta from previous captured frame: 0.000012000 seconds] [Time delta from previous displayed frame: 0.000012000 seconds] [Time since reference or first frame: 16.828453000 seconds] Frame Number: 6 Frame Length: 250 bytes Capture Length: 250 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f), Dst: 00:09:5b:2b:a8:d7 (00:09:5b:2b:a8:d7) Destination: 00:09:5b:2b:a8:d7 (00:09:5b:2b:a8:d7) Address: 00:09:5b:2b:a8:d7 (00:09:5b:2b:a8:d7) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) Address: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.124 (165.227.249.124), Dst: 165.227.249.125 (165.227.249.125) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 236 Identification: 0x0000 (0) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfb3f [correct] [Good: True] [Bad : False] Source: 165.227.249.124 (165.227.249.124) Destination: 165.227.249.125 (165.227.249.125) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 216 Checksum: 0x6785 [correct] [Good Checksum: True] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: 421633A1B8275EF1 Responder cookie: 0000000000000000 Next payload: Security Association (1) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags: 0x00 .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 208 Security Association payload Next payload: Vendor ID (13) Payload length: 60 Domain of interpretation: IPSEC (1) Situation: IDENTITY (1) Proposal payload # 0 Next payload: NONE (0) Payload length: 48 Proposal number: 0 Protocol ID: ISAKMP (1) SPI Size: 8 Proposal transforms: 1 SPI: 0x421633A1B8275EF1 Transform payload # 0 Next payload: NONE (0) Payload length: 32 Transform number: 0 Transform ID: KEY_IKE (1) Encryption-Algorithm (1): 3DES-CBC (5) Hash-Algorithm (2): SHA (2) Authentication-Method (3): PSK (1) Group-Description (4): Alternate 1024-bit MODP group (2) Life-Type (11): Seconds (1) Life-Duration (12): Duration-Value (28800) Vendor ID: F758F22668750F03B08DF6EBE1D00500 Next payload: Vendor ID (13) Payload length: 20 Vendor ID: F758F22668750F03B08DF6EBE1D00500 Vendor ID: draft-ietf-ipsec-nat-t-ike-02 Next payload: Vendor ID (13) Payload length: 20 Vendor ID: draft-ietf-ipsec-nat-t-ike-02 Vendor ID: draft-ietf-ipsec-nat-t-ike-02\n Next payload: Vendor ID (13) Payload length: 20 Vendor ID: draft-ietf-ipsec-nat-t-ike-02\n Vendor ID: draft-ietf-ipsec-nat-t-ike-03 Next payload: Vendor ID (13) Payload length: 20 Vendor ID: draft-ietf-ipsec-nat-t-ike-03 Vendor ID: RFC 3947 Negotiation of NAT-Traversal in the IKE Next payload: Vendor ID (13) Payload length: 20 Vendor ID: RFC 3947 Negotiation of NAT-Traversal in the IKE Vendor ID: RFC 3706 Detecting Dead IKE Peers (DPD) Next payload: NONE (0) Payload length: 20 Vendor ID: RFC 3706 Detecting Dead IKE Peers (DPD) 0000 00 09 5b 2b a8 d7 00 0c 29 48 f8 2f 08 00 45 00 ..[+....)H./..E. 0010 00 ec 00 00 40 00 40 11 fb 3f a5 e3 f9 7c a5 e3 ....@.@..?...|.. 0020 f9 7d 01 f4 01 f4 00 d8 67 85 42 16 33 a1 b8 27 .}......g.B.3..' 0030 5e f1 00 00 00 00 00 00 00 00 01 10 02 00 00 00 ^............... 0040 00 00 00 00 00 d0 0d 00 00 3c 00 00 00 01 00 00 .........<...... 0050 00 01 00 00 00 30 00 01 08 01 42 16 33 a1 b8 27 .....0....B.3..' 0060 5e f1 00 00 00 20 00 01 00 00 80 01 00 05 80 02 ^.... .......... 0070 00 02 80 03 00 01 80 04 00 02 80 0b 00 01 80 0c ................ 0080 70 80 0d 00 00 14 f7 58 f2 26 68 75 0f 03 b0 8d p......X.&hu.... 0090 f6 eb e1 d0 05 00 0d 00 00 14 cd 60 46 43 35 df ...........`FC5. 00a0 21 f8 7c fd b2 fc 68 b6 a4 48 0d 00 00 14 90 cb !.|...h..H...... 00b0 80 91 3e bb 69 6e 08 63 81 b5 ec 42 7b 1f 0d 00 ..>.in.c...B{... 00c0 00 14 7d 94 19 a6 53 10 ca 6f 2c 17 9d 92 15 52 ..}...S..o,....R 00d0 9d 56 0d 00 00 14 4a 13 1c 81 07 03 58 45 5c 57 .V....J.....XE\W 00e0 28 f2 0e 95 45 2f 00 00 00 14 af ca d7 13 68 a1 (...E/........h. 00f0 f1 c9 6b 86 96 fc 77 57 01 00 ..k...wW.. Frame 7 (130 bytes on wire, 130 bytes captured) Arrival Time: Oct 26, 2009 14:16:44.039017000 [Time delta from previous captured frame: 0.004544000 seconds] [Time delta from previous displayed frame: 0.004544000 seconds] [Time since reference or first frame: 16.832997000 seconds] Frame Number: 7 Frame Length: 130 bytes Capture Length: 130 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:09:5b:2b:a8:d7 (00:09:5b:2b:a8:d7), Dst: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) Destination: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) Address: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:09:5b:2b:a8:d7 (00:09:5b:2b:a8:d7) Address: 00:09:5b:2b:a8:d7 (00:09:5b:2b:a8:d7) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.125 (165.227.249.125), Dst: 165.227.249.124 (165.227.249.124) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 116 Identification: 0x0229 (553) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0x398f [correct] [Good: True] [Bad : False] Source: 165.227.249.125 (165.227.249.125) Destination: 165.227.249.124 (165.227.249.124) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 96 Checksum: 0x3fa7 [correct] [Good Checksum: True] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: 421633A1B8275EF1 Responder cookie: D92646B7A9F61CBF Next payload: Security Association (1) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags: 0x00 .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 88 Security Association payload Next payload: NONE (0) Payload length: 60 Domain of interpretation: IPSEC (1) Situation: IDENTITY (1) Proposal payload # 0 Next payload: NONE (0) Payload length: 48 Proposal number: 0 Protocol ID: ISAKMP (1) SPI Size: 8 Proposal transforms: 1 SPI: 0x421633A1B8275EF1 Transform payload # 0 Next payload: NONE (0) Payload length: 32 Transform number: 0 Transform ID: KEY_IKE (1) Encryption-Algorithm (1): 3DES-CBC (5) Hash-Algorithm (2): SHA (2) Authentication-Method (3): PSK (1) Group-Description (4): Alternate 1024-bit MODP group (2) Life-Type (11): Seconds (1) Life-Duration (12): Duration-Value (28800) 0000 00 0c 29 48 f8 2f 00 09 5b 2b a8 d7 08 00 45 00 ..)H./..[+....E. 0010 00 74 02 29 00 00 40 11 39 8f a5 e3 f9 7d a5 e3 .t.)..@.9....}.. 0020 f9 7c 01 f4 01 f4 00 60 3f a7 42 16 33 a1 b8 27 .|.....`?.B.3..' 0030 5e f1 d9 26 46 b7 a9 f6 1c bf 01 10 02 00 00 00 ^..&F........... 0040 00 00 00 00 00 58 00 00 00 3c 00 00 00 01 00 00 .....X...<...... 0050 00 01 00 00 00 30 00 01 08 01 42 16 33 a1 b8 27 .....0....B.3..' 0060 5e f1 00 00 00 20 00 01 00 00 80 01 00 05 80 02 ^.... .......... 0070 00 02 80 03 00 01 80 04 00 02 80 0b 00 01 80 0c ................ 0080 70 80 p. Frame 8 (222 bytes on wire, 222 bytes captured) Arrival Time: Oct 26, 2009 14:16:44.041535000 [Time delta from previous captured frame: 0.002518000 seconds] [Time delta from previous displayed frame: 0.002518000 seconds] [Time since reference or first frame: 16.835515000 seconds] Frame Number: 8 Frame Length: 222 bytes Capture Length: 222 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f), Dst: 00:09:5b:2b:a8:d7 (00:09:5b:2b:a8:d7) Destination: 00:09:5b:2b:a8:d7 (00:09:5b:2b:a8:d7) Address: 00:09:5b:2b:a8:d7 (00:09:5b:2b:a8:d7) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) Address: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.124 (165.227.249.124), Dst: 165.227.249.125 (165.227.249.125) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 208 Identification: 0x0000 (0) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfb5b [correct] [Good: True] [Bad : False] Source: 165.227.249.124 (165.227.249.124) Destination: 165.227.249.125 (165.227.249.125) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 188 Checksum: 0x07d6 [correct] [Good Checksum: True] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: 421633A1B8275EF1 Responder cookie: D92646B7A9F61CBF Next payload: Key Exchange (4) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags: 0x00 .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 180 Key Exchange payload Next payload: Nonce (10) Payload length: 132 Key Exchange Data (128 bytes / 1024 bits) Nonce payload Next payload: NONE (0) Payload length: 20 Nonce Data 0000 00 09 5b 2b a8 d7 00 0c 29 48 f8 2f 08 00 45 00 ..[+....)H./..E. 0010 00 d0 00 00 40 00 40 11 fb 5b a5 e3 f9 7c a5 e3 ....@.@..[...|.. 0020 f9 7d 01 f4 01 f4 00 bc 07 d6 42 16 33 a1 b8 27 .}........B.3..' 0030 5e f1 d9 26 46 b7 a9 f6 1c bf 04 10 02 00 00 00 ^..&F........... 0040 00 00 00 00 00 b4 0a 00 00 84 55 d0 31 13 b0 a5 ..........U.1... 0050 78 cb 75 4e 97 74 2a 46 13 c3 19 01 76 73 45 63 x.uN.t*F....vsEc 0060 2b 1d 6f 99 5d 1b 5b 50 93 cf b5 6f d3 34 74 7a +.o.].[P...o.4tz 0070 d5 4b ff d6 86 f5 88 be 61 62 11 f7 33 0c f6 2b .K......ab..3..+ 0080 9e ce f0 91 cd ab 19 4f a6 3f ed fd e3 0e 97 95 .......O.?...... 0090 39 cb 2f 65 6d b0 7a 43 4f c6 40 6b ec b4 bf ca 9./em.zCO.@k.... 00a0 5d 04 92 30 08 8d c2 20 fa 26 a5 7b 6d 23 40 14 ]..0... .&.{m#@. 00b0 d1 1f 56 f6 f5 12 da 61 31 7d f1 35 25 54 90 18 ..V....a1}.5%T.. 00c0 5b 76 35 78 d9 5a 01 1e ba 6a 00 00 00 14 27 08 [v5x.Z...j....'. 00d0 cd bb 46 02 07 42 9d 14 ff d6 a9 f3 61 8f ..F..B......a. Frame 9 (222 bytes on wire, 222 bytes captured) Arrival Time: Oct 26, 2009 14:16:44.041544000 [Time delta from previous captured frame: 0.000009000 seconds] [Time delta from previous displayed frame: 0.000009000 seconds] [Time since reference or first frame: 16.835524000 seconds] Frame Number: 9 Frame Length: 222 bytes Capture Length: 222 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f), Dst: 00:09:5b:2b:a8:d7 (00:09:5b:2b:a8:d7) Destination: 00:09:5b:2b:a8:d7 (00:09:5b:2b:a8:d7) Address: 00:09:5b:2b:a8:d7 (00:09:5b:2b:a8:d7) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) Address: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.124 (165.227.249.124), Dst: 165.227.249.125 (165.227.249.125) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 208 Identification: 0x0000 (0) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfb5b [correct] [Good: True] [Bad : False] Source: 165.227.249.124 (165.227.249.124) Destination: 165.227.249.125 (165.227.249.125) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 188 Checksum: 0x07d6 [correct] [Good Checksum: True] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: 421633A1B8275EF1 Responder cookie: D92646B7A9F61CBF Next payload: Key Exchange (4) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags: 0x00 .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 180 Key Exchange payload Next payload: Nonce (10) Payload length: 132 Key Exchange Data (128 bytes / 1024 bits) Nonce payload Next payload: NONE (0) Payload length: 20 Nonce Data 0000 00 09 5b 2b a8 d7 00 0c 29 48 f8 2f 08 00 45 00 ..[+....)H./..E. 0010 00 d0 00 00 40 00 40 11 fb 5b a5 e3 f9 7c a5 e3 ....@.@..[...|.. 0020 f9 7d 01 f4 01 f4 00 bc 07 d6 42 16 33 a1 b8 27 .}........B.3..' 0030 5e f1 d9 26 46 b7 a9 f6 1c bf 04 10 02 00 00 00 ^..&F........... 0040 00 00 00 00 00 b4 0a 00 00 84 55 d0 31 13 b0 a5 ..........U.1... 0050 78 cb 75 4e 97 74 2a 46 13 c3 19 01 76 73 45 63 x.uN.t*F....vsEc 0060 2b 1d 6f 99 5d 1b 5b 50 93 cf b5 6f d3 34 74 7a +.o.].[P...o.4tz 0070 d5 4b ff d6 86 f5 88 be 61 62 11 f7 33 0c f6 2b .K......ab..3..+ 0080 9e ce f0 91 cd ab 19 4f a6 3f ed fd e3 0e 97 95 .......O.?...... 0090 39 cb 2f 65 6d b0 7a 43 4f c6 40 6b ec b4 bf ca 9./em.zCO.@k.... 00a0 5d 04 92 30 08 8d c2 20 fa 26 a5 7b 6d 23 40 14 ]..0... .&.{m#@. 00b0 d1 1f 56 f6 f5 12 da 61 31 7d f1 35 25 54 90 18 ..V....a1}.5%T.. 00c0 5b 76 35 78 d9 5a 01 1e ba 6a 00 00 00 14 27 08 [v5x.Z...j....'. 00d0 cd bb 46 02 07 42 9d 14 ff d6 a9 f3 61 8f ..F..B......a. Frame 10 (214 bytes on wire, 214 bytes captured) Arrival Time: Oct 26, 2009 14:16:44.448062000 [Time delta from previous captured frame: 0.406518000 seconds] [Time delta from previous displayed frame: 0.406518000 seconds] [Time since reference or first frame: 17.242042000 seconds] Frame Number: 10 Frame Length: 214 bytes Capture Length: 214 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:09:5b:2b:a8:d7 (00:09:5b:2b:a8:d7), Dst: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) Destination: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) Address: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:09:5b:2b:a8:d7 (00:09:5b:2b:a8:d7) Address: 00:09:5b:2b:a8:d7 (00:09:5b:2b:a8:d7) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.125 (165.227.249.125), Dst: 165.227.249.124 (165.227.249.124) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 200 Identification: 0x022a (554) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0x393a [correct] [Good: True] [Bad : False] Source: 165.227.249.125 (165.227.249.125) Destination: 165.227.249.124 (165.227.249.124) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 180 Checksum: 0xb0f0 [correct] [Good Checksum: True] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: 421633A1B8275EF1 Responder cookie: D92646B7A9F61CBF Next payload: Key Exchange (4) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags: 0x00 .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 172 Key Exchange payload Next payload: Nonce (10) Payload length: 132 Key Exchange Data (128 bytes / 1024 bits) Nonce payload Next payload: NONE (0) Payload length: 12 Nonce Data 0000 00 0c 29 48 f8 2f 00 09 5b 2b a8 d7 08 00 45 00 ..)H./..[+....E. 0010 00 c8 02 2a 00 00 40 11 39 3a a5 e3 f9 7d a5 e3 ...*..@.9:...}.. 0020 f9 7c 01 f4 01 f4 00 b4 b0 f0 42 16 33 a1 b8 27 .|........B.3..' 0030 5e f1 d9 26 46 b7 a9 f6 1c bf 04 10 02 00 00 00 ^..&F........... 0040 00 00 00 00 00 ac 0a 00 00 84 92 c5 fd 5c 6f 47 .............\oG 0050 b4 9e 46 26 cc 8d 6d ae 7a 81 86 1e 1e 37 7a 2f ..F&..m.z....7z/ 0060 e3 11 e3 1c d2 f5 08 91 2d d8 e5 f3 d1 e6 c2 7c ........-......| 0070 f2 bf 0e 87 67 87 f9 e0 95 99 93 ad b6 42 55 bf ....g........BU. 0080 49 a5 85 d4 18 6e 51 e4 65 bd 8f 20 6f f2 1c 85 I....nQ.e.. o... 0090 a0 54 f6 a8 40 2b f6 19 d4 c7 8c 2d 47 a6 e2 4d .T..@+.....-G..M 00a0 04 da 14 6e 94 56 42 4c b4 71 2f d0 74 e2 cc 40 ...n.VBL.q/.t..@ 00b0 8d b0 14 29 b0 1b c5 ef 5e 6d 54 55 23 90 20 2f ...)....^mTU#. / 00c0 57 09 82 84 8e d5 34 29 fd 5c 00 00 00 0c f7 80 W.....4).\...... 00d0 b8 95 a2 8f b3 56 .....V Frame 11 (134 bytes on wire, 134 bytes captured) Arrival Time: Oct 26, 2009 14:16:44.452404000 [Time delta from previous captured frame: 0.004342000 seconds] [Time delta from previous displayed frame: 0.004342000 seconds] [Time since reference or first frame: 17.246384000 seconds] Frame Number: 11 Frame Length: 134 bytes Capture Length: 134 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f), Dst: 00:09:5b:2b:a8:d7 (00:09:5b:2b:a8:d7) Destination: 00:09:5b:2b:a8:d7 (00:09:5b:2b:a8:d7) Address: 00:09:5b:2b:a8:d7 (00:09:5b:2b:a8:d7) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) Address: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.124 (165.227.249.124), Dst: 165.227.249.125 (165.227.249.125) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 120 Identification: 0x0000 (0) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfbb3 [correct] [Good: True] [Bad : False] Source: 165.227.249.124 (165.227.249.124) Destination: 165.227.249.125 (165.227.249.125) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 100 Checksum: 0x873f [correct] [Good Checksum: True] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: 421633A1B8275EF1 Responder cookie: D92646B7A9F61CBF Next payload: Identification (5) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags: 0x01 .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 92 Encrypted payload (64 bytes) 0000 00 09 5b 2b a8 d7 00 0c 29 48 f8 2f 08 00 45 00 ..[+....)H./..E. 0010 00 78 00 00 40 00 40 11 fb b3 a5 e3 f9 7c a5 e3 .x..@.@......|.. 0020 f9 7d 01 f4 01 f4 00 64 87 3f 42 16 33 a1 b8 27 .}.....d.?B.3..' 0030 5e f1 d9 26 46 b7 a9 f6 1c bf 05 10 02 01 00 00 ^..&F........... 0040 00 00 00 00 00 5c d2 cc 17 89 0d 0b 43 28 33 13 .....\......C(3. 0050 22 94 8c 05 73 c7 a3 de 3a 4d 79 dc 03 61 41 28 "...s...:My..aA( 0060 33 45 24 da de a4 37 71 56 48 d7 6d d8 9e 58 68 3E$...7qVH.m..Xh 0070 c4 54 47 52 6d ac a7 2b 02 94 c8 88 5a c4 88 f4 .TGRm..+....Z... 0080 6d 7a 06 45 7d d5 mz.E}. Frame 12 (134 bytes on wire, 134 bytes captured) Arrival Time: Oct 26, 2009 14:16:44.452416000 [Time delta from previous captured frame: 0.000012000 seconds] [Time delta from previous displayed frame: 0.000012000 seconds] [Time since reference or first frame: 17.246396000 seconds] Frame Number: 12 Frame Length: 134 bytes Capture Length: 134 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f), Dst: 00:09:5b:2b:a8:d7 (00:09:5b:2b:a8:d7) Destination: 00:09:5b:2b:a8:d7 (00:09:5b:2b:a8:d7) Address: 00:09:5b:2b:a8:d7 (00:09:5b:2b:a8:d7) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) Address: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.124 (165.227.249.124), Dst: 165.227.249.125 (165.227.249.125) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 120 Identification: 0x0000 (0) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfbb3 [correct] [Good: True] [Bad : False] Source: 165.227.249.124 (165.227.249.124) Destination: 165.227.249.125 (165.227.249.125) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 100 Checksum: 0x873f [correct] [Good Checksum: True] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: 421633A1B8275EF1 Responder cookie: D92646B7A9F61CBF Next payload: Identification (5) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags: 0x01 .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 92 Encrypted payload (64 bytes) 0000 00 09 5b 2b a8 d7 00 0c 29 48 f8 2f 08 00 45 00 ..[+....)H./..E. 0010 00 78 00 00 40 00 40 11 fb b3 a5 e3 f9 7c a5 e3 .x..@.@......|.. 0020 f9 7d 01 f4 01 f4 00 64 87 3f 42 16 33 a1 b8 27 .}.....d.?B.3..' 0030 5e f1 d9 26 46 b7 a9 f6 1c bf 05 10 02 01 00 00 ^..&F........... 0040 00 00 00 00 00 5c d2 cc 17 89 0d 0b 43 28 33 13 .....\......C(3. 0050 22 94 8c 05 73 c7 a3 de 3a 4d 79 dc 03 61 41 28 "...s...:My..aA( 0060 33 45 24 da de a4 37 71 56 48 d7 6d d8 9e 58 68 3E$...7qVH.m..Xh 0070 c4 54 47 52 6d ac a7 2b 02 94 c8 88 5a c4 88 f4 .TGRm..+....Z... 0080 6d 7a 06 45 7d d5 mz.E}. Frame 13 (110 bytes on wire, 110 bytes captured) Arrival Time: Oct 26, 2009 14:16:44.946500000 [Time delta from previous captured frame: 0.494084000 seconds] [Time delta from previous displayed frame: 0.494084000 seconds] [Time since reference or first frame: 17.740480000 seconds] Frame Number: 13 Frame Length: 110 bytes Capture Length: 110 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:09:5b:2b:a8:d7 (00:09:5b:2b:a8:d7), Dst: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) Destination: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) Address: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:09:5b:2b:a8:d7 (00:09:5b:2b:a8:d7) Address: 00:09:5b:2b:a8:d7 (00:09:5b:2b:a8:d7) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.125 (165.227.249.125), Dst: 165.227.249.124 (165.227.249.124) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 96 Identification: 0x022b (555) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0x39a1 [correct] [Good: True] [Bad : False] Source: 165.227.249.125 (165.227.249.125) Destination: 165.227.249.124 (165.227.249.124) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 76 Checksum: 0x2a4c [correct] [Good Checksum: True] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: 421633A1B8275EF1 Responder cookie: D92646B7A9F61CBF Next payload: Identification (5) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags: 0x01 .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 68 Encrypted payload (40 bytes) 0000 00 0c 29 48 f8 2f 00 09 5b 2b a8 d7 08 00 45 00 ..)H./..[+....E. 0010 00 60 02 2b 00 00 40 11 39 a1 a5 e3 f9 7d a5 e3 .`.+..@.9....}.. 0020 f9 7c 01 f4 01 f4 00 4c 2a 4c 42 16 33 a1 b8 27 .|.....L*LB.3..' 0030 5e f1 d9 26 46 b7 a9 f6 1c bf 05 10 02 01 00 00 ^..&F........... 0040 00 00 00 00 00 44 e2 67 8a 83 c6 eb 31 54 d1 f4 .....D.g....1T.. 0050 2e 4a 6f ce 49 93 2f 11 3e ee b3 43 98 ec 3b 59 .Jo.I./.>..C..;Y 0060 a9 15 5a 7b 8a 38 3b d0 85 cd a9 b4 0a 36 ..Z{.8;......6 Frame 14 (374 bytes on wire, 374 bytes captured) Arrival Time: Oct 26, 2009 14:16:44.954678000 [Time delta from previous captured frame: 0.008178000 seconds] [Time delta from previous displayed frame: 0.008178000 seconds] [Time since reference or first frame: 17.748658000 seconds] Frame Number: 14 Frame Length: 374 bytes Capture Length: 374 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f), Dst: 00:09:5b:2b:a8:d7 (00:09:5b:2b:a8:d7) Destination: 00:09:5b:2b:a8:d7 (00:09:5b:2b:a8:d7) Address: 00:09:5b:2b:a8:d7 (00:09:5b:2b:a8:d7) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) Address: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.124 (165.227.249.124), Dst: 165.227.249.125 (165.227.249.125) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 360 Identification: 0x0000 (0) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfac3 [correct] [Good: True] [Bad : False] Source: 165.227.249.124 (165.227.249.124) Destination: 165.227.249.125 (165.227.249.125) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 340 Checksum: 0xe98f [correct] [Good Checksum: True] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: 421633A1B8275EF1 Responder cookie: D92646B7A9F61CBF Next payload: Hash (8) Version: 1.0 Exchange type: Quick Mode (32) Flags: 0x01 .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x855d4949 Length: 332 Encrypted payload (304 bytes) 0000 00 09 5b 2b a8 d7 00 0c 29 48 f8 2f 08 00 45 00 ..[+....)H./..E. 0010 01 68 00 00 40 00 40 11 fa c3 a5 e3 f9 7c a5 e3 .h..@.@......|.. 0020 f9 7d 01 f4 01 f4 01 54 e9 8f 42 16 33 a1 b8 27 .}.....T..B.3..' 0030 5e f1 d9 26 46 b7 a9 f6 1c bf 08 10 20 01 85 5d ^..&F....... ..] 0040 49 49 00 00 01 4c 21 23 cc 48 c8 28 9c d4 ab b1 II...L!#.H.(.... 0050 f0 9f 74 a0 ee ea 6e a3 75 42 d1 02 6f 0a 31 b4 ..t...n.uB..o.1. 0060 fe c6 24 0d b8 28 8c cb 5c 5c ed 3c 31 0d de 57 ..$..(..\\.<1..W 0070 54 8a 46 d4 11 0f 82 c9 c7 13 3d 3b 7d 42 51 a8 T.F.......=;}BQ. 0080 71 b3 07 ad 85 49 51 ee 6c f6 8d cd 45 36 0b ce q....IQ.l...E6.. 0090 6d 73 39 b3 60 0b ec 8b 15 cd af 88 bf e4 89 9e ms9.`........... 00a0 b7 f6 4f c4 d3 5d 5f d6 4e 80 29 b1 7a 16 cc d5 ..O..]_.N.).z... 00b0 bc 51 4f 36 dc 09 bf 27 32 3d 9e 02 f5 2d b5 f3 .QO6...'2=...-.. 00c0 ef ec 15 54 4f 2f 36 25 a1 92 7d 33 8b a8 92 8d ...TO/6%..}3.... 00d0 d9 cd 84 59 be 9b d9 a1 61 90 6e 15 ad 11 20 fe ...Y....a.n... . 00e0 48 ac 69 9e 36 59 7d 67 c2 bd f9 dc 1c 93 2f 2f H.i.6Y}g......// 00f0 10 66 4b 52 34 80 ed 44 69 77 46 6e 5e 33 9d 0a .fKR4..DiwFn^3.. 0100 a0 5c ca 65 a6 9e 9b 6a 0c 6f a3 05 da 61 2a d5 .\.e...j.o...a*. 0110 35 96 0c e8 d0 28 c9 2d 11 64 3c 00 88 79 b4 9b 5....(.-.d<..y.. 0120 f8 9a 41 6d 61 a9 bc ab ab 9f d1 81 d6 21 84 ce ..Ama........!.. 0130 56 de 98 c9 c3 29 0b 55 9a 49 08 7e 9f 8e 97 a2 V....).U.I.~.... 0140 00 20 2a 2f a3 53 b1 9c a9 60 2b 95 7c d9 09 41 . */.S...`+.|..A 0150 45 21 51 87 6f 0d cb d0 fa ed 9b 1e 35 dd a9 49 E!Q.o.......5..I 0160 5c 56 01 0f 6a b8 35 18 62 b6 46 0f 6a ee 0f 52 \V..j.5.b.F.j..R 0170 53 e6 0a fc 1c 2c S...., Frame 15 (374 bytes on wire, 374 bytes captured) Arrival Time: Oct 26, 2009 14:16:44.954693000 [Time delta from previous captured frame: 0.000015000 seconds] [Time delta from previous displayed frame: 0.000015000 seconds] [Time since reference or first frame: 17.748673000 seconds] Frame Number: 15 Frame Length: 374 bytes Capture Length: 374 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f), Dst: 00:09:5b:2b:a8:d7 (00:09:5b:2b:a8:d7) Destination: 00:09:5b:2b:a8:d7 (00:09:5b:2b:a8:d7) Address: 00:09:5b:2b:a8:d7 (00:09:5b:2b:a8:d7) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) Address: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.124 (165.227.249.124), Dst: 165.227.249.125 (165.227.249.125) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 360 Identification: 0x0000 (0) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfac3 [correct] [Good: True] [Bad : False] Source: 165.227.249.124 (165.227.249.124) Destination: 165.227.249.125 (165.227.249.125) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 340 Checksum: 0xe98f [correct] [Good Checksum: True] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: 421633A1B8275EF1 Responder cookie: D92646B7A9F61CBF Next payload: Hash (8) Version: 1.0 Exchange type: Quick Mode (32) Flags: 0x01 .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x855d4949 Length: 332 Encrypted payload (304 bytes) 0000 00 09 5b 2b a8 d7 00 0c 29 48 f8 2f 08 00 45 00 ..[+....)H./..E. 0010 01 68 00 00 40 00 40 11 fa c3 a5 e3 f9 7c a5 e3 .h..@.@......|.. 0020 f9 7d 01 f4 01 f4 01 54 e9 8f 42 16 33 a1 b8 27 .}.....T..B.3..' 0030 5e f1 d9 26 46 b7 a9 f6 1c bf 08 10 20 01 85 5d ^..&F....... ..] 0040 49 49 00 00 01 4c 21 23 cc 48 c8 28 9c d4 ab b1 II...L!#.H.(.... 0050 f0 9f 74 a0 ee ea 6e a3 75 42 d1 02 6f 0a 31 b4 ..t...n.uB..o.1. 0060 fe c6 24 0d b8 28 8c cb 5c 5c ed 3c 31 0d de 57 ..$..(..\\.<1..W 0070 54 8a 46 d4 11 0f 82 c9 c7 13 3d 3b 7d 42 51 a8 T.F.......=;}BQ. 0080 71 b3 07 ad 85 49 51 ee 6c f6 8d cd 45 36 0b ce q....IQ.l...E6.. 0090 6d 73 39 b3 60 0b ec 8b 15 cd af 88 bf e4 89 9e ms9.`........... 00a0 b7 f6 4f c4 d3 5d 5f d6 4e 80 29 b1 7a 16 cc d5 ..O..]_.N.).z... 00b0 bc 51 4f 36 dc 09 bf 27 32 3d 9e 02 f5 2d b5 f3 .QO6...'2=...-.. 00c0 ef ec 15 54 4f 2f 36 25 a1 92 7d 33 8b a8 92 8d ...TO/6%..}3.... 00d0 d9 cd 84 59 be 9b d9 a1 61 90 6e 15 ad 11 20 fe ...Y....a.n... . 00e0 48 ac 69 9e 36 59 7d 67 c2 bd f9 dc 1c 93 2f 2f H.i.6Y}g......// 00f0 10 66 4b 52 34 80 ed 44 69 77 46 6e 5e 33 9d 0a .fKR4..DiwFn^3.. 0100 a0 5c ca 65 a6 9e 9b 6a 0c 6f a3 05 da 61 2a d5 .\.e...j.o...a*. 0110 35 96 0c e8 d0 28 c9 2d 11 64 3c 00 88 79 b4 9b 5....(.-.d<..y.. 0120 f8 9a 41 6d 61 a9 bc ab ab 9f d1 81 d6 21 84 ce ..Ama........!.. 0130 56 de 98 c9 c3 29 0b 55 9a 49 08 7e 9f 8e 97 a2 V....).U.I.~.... 0140 00 20 2a 2f a3 53 b1 9c a9 60 2b 95 7c d9 09 41 . */.S...`+.|..A 0150 45 21 51 87 6f 0d cb d0 fa ed 9b 1e 35 dd a9 49 E!Q.o.......5..I 0160 5c 56 01 0f 6a b8 35 18 62 b6 46 0f 6a ee 0f 52 \V..j.5.b.F.j..R 0170 53 e6 0a fc 1c 2c S...., Frame 16 (326 bytes on wire, 326 bytes captured) Arrival Time: Oct 26, 2009 14:16:45.362281000 [Time delta from previous captured frame: 0.407588000 seconds] [Time delta from previous displayed frame: 0.407588000 seconds] [Time since reference or first frame: 18.156261000 seconds] Frame Number: 16 Frame Length: 326 bytes Capture Length: 326 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:09:5b:2b:a8:d7 (00:09:5b:2b:a8:d7), Dst: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) Destination: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) Address: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:09:5b:2b:a8:d7 (00:09:5b:2b:a8:d7) Address: 00:09:5b:2b:a8:d7 (00:09:5b:2b:a8:d7) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.125 (165.227.249.125), Dst: 165.227.249.124 (165.227.249.124) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 312 Identification: 0x022c (556) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0x38c8 [correct] [Good: True] [Bad : False] Source: 165.227.249.125 (165.227.249.125) Destination: 165.227.249.124 (165.227.249.124) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 292 Checksum: 0xebaf [correct] [Good Checksum: True] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: 421633A1B8275EF1 Responder cookie: D92646B7A9F61CBF Next payload: Hash (8) Version: 1.0 Exchange type: Quick Mode (32) Flags: 0x01 .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x855d4949 Length: 284 Encrypted payload (256 bytes) 0000 00 0c 29 48 f8 2f 00 09 5b 2b a8 d7 08 00 45 00 ..)H./..[+....E. 0010 01 38 02 2c 00 00 40 11 38 c8 a5 e3 f9 7d a5 e3 .8.,..@.8....}.. 0020 f9 7c 01 f4 01 f4 01 24 eb af 42 16 33 a1 b8 27 .|.....$..B.3..' 0030 5e f1 d9 26 46 b7 a9 f6 1c bf 08 10 20 01 85 5d ^..&F....... ..] 0040 49 49 00 00 01 1c 2a 33 39 d9 22 e1 8b d0 39 ec II....*39."...9. 0050 fc 61 ef ba 5b 8b 12 57 d4 2e db bd 29 da b9 0e .a..[..W....)... 0060 19 e1 b2 48 ae 29 2a 71 04 94 85 3b 74 9d 35 df ...H.)*q...;t.5. 0070 6b 84 ca 92 bd 9c 7f 1b c2 9e de 9b 70 90 15 b2 k...........p... 0080 67 74 24 8a c5 44 63 c8 9a 3f 4b 65 76 0b 50 65 gt$..Dc..?Kev.Pe 0090 82 4d 04 9f 31 cb 17 e3 c6 67 02 6d 64 77 48 f6 .M..1....g.mdwH. 00a0 9b e4 62 9b 73 42 8e 44 3d dc 35 bc c3 b9 28 a1 ..b.sB.D=.5...(. 00b0 3b 95 a1 96 47 02 e7 0d bc 1c be 35 2c 89 ff 21 ;...G......5,..! 00c0 ad da 44 56 fa f2 a8 59 53 02 cb 5e f0 e4 0e c9 ..DV...YS..^.... 00d0 9a b9 91 ad 57 81 77 34 18 df 35 55 b1 61 d4 d1 ....W.w4..5U.a.. 00e0 5a 67 a9 d9 62 0a e3 63 90 0f 95 a9 8b 58 ae de Zg..b..c.....X.. 00f0 21 2b 2e de c9 da ac 2d a3 8a 05 c9 07 a8 c7 20 !+.....-....... 0100 ca df d4 f7 4d 70 29 69 5b 56 1a 18 c7 c0 40 61 ....Mp)i[V....@a 0110 b0 32 4c 7f 0b db eb 08 48 14 fa 1d 42 09 b3 65 .2L.....H...B..e 0120 fa 49 2c d1 4c 1a cb f3 c9 ba cc f7 a2 0c 98 5c .I,.L..........\ 0130 af 7f 82 88 44 bc 25 12 1f b5 17 aa d2 6e fd a3 ....D.%......n.. 0140 8c f6 94 6a fe bd ...j.. Frame 17 (94 bytes on wire, 94 bytes captured) Arrival Time: Oct 26, 2009 14:16:45.366427000 [Time delta from previous captured frame: 0.004146000 seconds] [Time delta from previous displayed frame: 0.004146000 seconds] [Time since reference or first frame: 18.160407000 seconds] Frame Number: 17 Frame Length: 94 bytes Capture Length: 94 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f), Dst: 00:09:5b:2b:a8:d7 (00:09:5b:2b:a8:d7) Destination: 00:09:5b:2b:a8:d7 (00:09:5b:2b:a8:d7) Address: 00:09:5b:2b:a8:d7 (00:09:5b:2b:a8:d7) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) Address: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.124 (165.227.249.124), Dst: 165.227.249.125 (165.227.249.125) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 80 Identification: 0x0000 (0) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfbdb [correct] [Good: True] [Bad : False] Source: 165.227.249.124 (165.227.249.124) Destination: 165.227.249.125 (165.227.249.125) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 60 Checksum: 0x647a [correct] [Good Checksum: True] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: 421633A1B8275EF1 Responder cookie: D92646B7A9F61CBF Next payload: Hash (8) Version: 1.0 Exchange type: Quick Mode (32) Flags: 0x01 .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x855d4949 Length: 52 Encrypted payload (24 bytes) 0000 00 09 5b 2b a8 d7 00 0c 29 48 f8 2f 08 00 45 00 ..[+....)H./..E. 0010 00 50 00 00 40 00 40 11 fb db a5 e3 f9 7c a5 e3 .P..@.@......|.. 0020 f9 7d 01 f4 01 f4 00 3c 64 7a 42 16 33 a1 b8 27 .}.....)...#.. 0070 bc 5c 60 d7 4d 22 6f dd ec 8c 71 ef 10 cd .\`.M"o...q... Frame 23 (126 bytes on wire, 126 bytes captured) Arrival Time: Oct 26, 2009 14:16:45.866813000 [Time delta from previous captured frame: 0.000014000 seconds] [Time delta from previous displayed frame: 0.000014000 seconds] [Time since reference or first frame: 18.660793000 seconds] Frame Number: 23 Frame Length: 126 bytes Capture Length: 126 bytes [Frame is marked: False] [Protocols in frame: eth:ip:esp] Ethernet II, Src: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f), Dst: 00:09:5b:2b:a8:d7 (00:09:5b:2b:a8:d7) Destination: 00:09:5b:2b:a8:d7 (00:09:5b:2b:a8:d7) Address: 00:09:5b:2b:a8:d7 (00:09:5b:2b:a8:d7) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) Address: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.124 (165.227.249.124), Dst: 165.227.249.125 (165.227.249.125) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 112 Identification: 0x0007 (7) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 240 Protocol: ESP (0x32) Header checksum: 0x8b93 [correct] [Good: True] [Bad : False] Source: 165.227.249.124 (165.227.249.124) Destination: 165.227.249.125 (165.227.249.125) Encapsulating Security Payload ESP SPI: 0xf58056a1 ESP Sequence: 2 0000 00 09 5b 2b a8 d7 00 0c 29 48 f8 2f 08 00 45 00 ..[+....)H./..E. 0010 00 70 00 07 00 00 f0 32 8b 93 a5 e3 f9 7c a5 e3 .p.....2.....|.. 0020 f9 7d f5 80 56 a1 00 00 00 02 ba ad 84 8c 24 c0 .}..V.........$. 0030 78 59 ef ec 2a ec a8 db 9f 6f b7 b3 11 b1 f3 36 xY..*....o.....6 0040 c3 8a 7a 8e fd d3 e0 4f a3 b9 e7 ea 6f 60 35 96 ..z....O....o`5. 0050 59 5d c3 cf 9d a3 77 ce 79 b8 c5 88 20 6f 11 b9 Y]....w.y... o.. 0060 23 39 ee 47 f8 9a 15 44 3e 29 cb b0 bc 23 a9 a7 #9.G...D>)...#.. 0070 bc 5c 60 d7 4d 22 6f dd ec 8c 71 ef 10 cd .\`.M"o...q... Frame 24 (126 bytes on wire, 126 bytes captured) Arrival Time: Oct 26, 2009 14:16:45.868680000 [Time delta from previous captured frame: 0.001867000 seconds] [Time delta from previous displayed frame: 0.001867000 seconds] [Time since reference or first frame: 18.662660000 seconds] Frame Number: 24 Frame Length: 126 bytes Capture Length: 126 bytes [Frame is marked: False] [Protocols in frame: eth:ip:esp] Ethernet II, Src: 00:09:5b:2b:a8:d7 (00:09:5b:2b:a8:d7), Dst: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) Destination: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) Address: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:09:5b:2b:a8:d7 (00:09:5b:2b:a8:d7) Address: 00:09:5b:2b:a8:d7 (00:09:5b:2b:a8:d7) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.125 (165.227.249.125), Dst: 165.227.249.124 (165.227.249.124) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 112 Identification: 0xf0a0 (61600) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 30 Protocol: ESP (0x32) Header checksum: 0x6cfa [correct] [Good: True] [Bad : False] Source: 165.227.249.125 (165.227.249.125) Destination: 165.227.249.124 (165.227.249.124) Encapsulating Security Payload ESP SPI: 0x0be5f962 ESP Sequence: 2 0000 00 0c 29 48 f8 2f 00 09 5b 2b a8 d7 08 00 45 00 ..)H./..[+....E. 0010 00 70 f0 a0 00 00 1e 32 6c fa a5 e3 f9 7d a5 e3 .p.....2l....}.. 0020 f9 7c 0b e5 f9 62 00 00 00 02 12 f8 a9 7f 5f d7 .|...b........_. 0030 18 3d e7 03 96 fe 00 1e 3c 4a e2 4e c2 e4 5c e0 .=......