Frame 1 (270 bytes on wire, 270 bytes captured) Arrival Time: Mar 22, 2004 14:06:39.710153000 Time delta from previous packet: 0.000000000 seconds Time since reference or first frame: 0.000000000 seconds Frame Number: 1 Packet Length: 270 bytes Capture Length: 270 bytes Ethernet II, Src: 00:0c:29:e6:ad:b9, Dst: 00:05:00:b8:00:e0 Destination: 00:05:00:b8:00:e0 (00:05:00:b8:00:e0) Source: 00:0c:29:e6:ad:b9 (00:0c:29:e6:ad:b9) Type: IP (0x0800) Frame check sequence: 0x1c92c40e (correct) Internet Protocol, Src Addr: 165.227.249.124 (165.227.249.124), Dst Addr: 165.227.249.126 (165.227.249.126) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 252 Identification: 0x0a97 (2711) Flags: 0x00 .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0x3098 (correct) Source: 165.227.249.124 (165.227.249.124) Destination: 165.227.249.126 (165.227.249.126) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 232 Checksum: 0xe66d (correct) Internet Security Association and Key Management Protocol Initiator cookie: 0x62BB7FFD1B9CE49C Responder cookie: 0x0000000000000000 Next payload: Security Association (1) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...0 = No encryption .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 224 Security Association payload Next payload: Vendor ID (13) Length: 56 Domain of interpretation: IPSEC (1) Situation: IDENTITY (1) Proposal payload # 0 Next payload: NONE (0) Length: 44 Proposal number: 0 Protocol ID: ISAKMP (1) SPI size: 0 Number of transforms: 1 Transform payload # 0 Next payload: NONE (0) Length: 36 Transform number: 0 Transform ID: KEY_IKE (1) Encryption-Algorithm (1): AES-CBC (7) Key-Length (14): Key-Length (128) Hash-Algorithm (2): SHA (2) Authentication-Method (3): PSK (1) Group-Description (4): Alternate 1024-bit MODP group (2) Life-Type (11): Seconds (1) Life-Duration (12): Duration-Value (28800) Vendor ID payload Next payload: Vendor ID (13) Length: 20 Vendor ID: unknown vendor ID: 0x8F9CC94E01248ECDF147594C284B213B Vendor ID payload Next payload: Vendor ID (13) Length: 20 Vendor ID: draft-stenberg-ipsec-nat-traversal-01 Vendor ID payload Next payload: Vendor ID (13) Length: 20 Vendor ID: draft-stenberg-ipsec-nat-traversal-02 Vendor ID payload Next payload: Vendor ID (13) Length: 20 Vendor ID: draft-ietf-ipsec-nat-t-ike-00 Vendor ID payload Next payload: Vendor ID (13) Length: 20 Vendor ID: draft-ietf-ipsec-nat-t-ike-02 Vendor ID payload Next payload: Vendor ID (13) Length: 20 Vendor ID: draft-ietf-ipsec-nat-t-ike-02 Vendor ID payload Next payload: NONE (0) Length: 20 Vendor ID: draft-ietf-ipsec-nat-t-ike-03 0000 00 05 00 b8 00 e0 00 0c 29 e6 ad b9 08 00 45 00 ........).....E. 0010 00 fc 0a 97 00 00 40 11 30 98 a5 e3 f9 7c a5 e3 ......@.0....|.. 0020 f9 7e 01 f4 01 f4 00 e8 e6 6d 62 bb 7f fd 1b 9c .~.......mb..... 0030 e4 9c 00 00 00 00 00 00 00 00 01 10 02 00 00 00 ................ 0040 00 00 00 00 00 e0 0d 00 00 38 00 00 00 01 00 00 .........8...... 0050 00 01 00 00 00 2c 00 01 00 01 00 00 00 24 00 01 .....,.......$.. 0060 00 00 80 01 00 07 80 0e 00 80 80 02 00 02 80 03 ................ 0070 00 01 80 04 00 02 80 0b 00 01 80 0c 70 80 0d 00 ............p... 0080 00 14 8f 9c c9 4e 01 24 8e cd f1 47 59 4c 28 4b .....N.$...GYL(K 0090 21 3b 0d 00 00 14 27 ba b5 dc 01 ea 07 60 ea 4e !;....'......`.N 00a0 31 90 ac 27 c0 d0 0d 00 00 14 61 05 c4 22 e7 68 1..'......a..".h 00b0 47 e4 3f 96 84 80 12 92 ae cd 0d 00 00 14 44 85 G.?...........D. 00c0 15 2d 18 b6 bb cd 0b e8 a8 46 95 79 dd cc 0d 00 .-.......F.y.... 00d0 00 14 cd 60 46 43 35 df 21 f8 7c fd b2 fc 68 b6 ...`FC5.!.|...h. 00e0 a4 48 0d 00 00 14 90 cb 80 91 3e bb 69 6e 08 63 .H........>.in.c 00f0 81 b5 ec 42 7b 1f 00 00 00 14 7d 94 19 a6 53 10 ...B{.....}...S. 0100 ca 6f 2c 17 9d 92 15 52 9d 56 1c 92 c4 0e .o,....R.V.... Frame 2 (154 bytes on wire, 154 bytes captured) Arrival Time: Mar 22, 2004 14:06:39.821448000 Time delta from previous packet: 0.111295000 seconds Time since reference or first frame: 0.111295000 seconds Frame Number: 2 Packet Length: 154 bytes Capture Length: 154 bytes Ethernet II, Src: 00:05:00:b8:00:e0, Dst: 00:0c:29:e6:ad:b9 Destination: 00:0c:29:e6:ad:b9 (00:0c:29:e6:ad:b9) Source: 00:05:00:b8:00:e0 (00:05:00:b8:00:e0) Type: IP (0x0800) Frame check sequence: 0xb804334e (correct) Internet Protocol, Src Addr: 165.227.249.126 (165.227.249.126), Dst Addr: 165.227.249.124 (165.227.249.124) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 136 Identification: 0x0001 (1) Flags: 0x00 .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: UDP (0x11) Header checksum: 0xfba1 (correct) Source: 165.227.249.126 (165.227.249.126) Destination: 165.227.249.124 (165.227.249.124) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 116 Checksum: 0xe025 (correct) Internet Security Association and Key Management Protocol Initiator cookie: 0x62BB7FFD1B9CE49C Responder cookie: 0x02E83467734E73D3 Next payload: Security Association (1) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...0 = No encryption .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 108 Security Association payload Next payload: Vendor ID (13) Length: 56 Domain of interpretation: IPSEC (1) Situation: IDENTITY (1) Proposal payload # 1 Next payload: NONE (0) Length: 44 Proposal number: 1 Protocol ID: ISAKMP (1) SPI size: 0 Number of transforms: 1 Transform payload # 0 Next payload: NONE (0) Length: 36 Transform number: 0 Transform ID: KEY_IKE (1) Encryption-Algorithm (1): AES-CBC (7) Key-Length (14): Key-Length (128) Hash-Algorithm (2): SHA (2) Group-Description (4): Alternate 1024-bit MODP group (2) Authentication-Method (3): PSK (1) Life-Type (11): Seconds (1) Life-Duration (12): Duration-Value (28800) Vendor ID payload Next payload: NONE (0) Length: 24 Vendor ID: Microsoft L2TP/IPSec VPN Client 0000 00 0c 29 e6 ad b9 00 05 00 b8 00 e0 08 00 45 00 ..)...........E. 0010 00 88 00 01 00 00 80 11 fb a1 a5 e3 f9 7e a5 e3 .............~.. 0020 f9 7c 01 f4 01 f4 00 74 e0 25 62 bb 7f fd 1b 9c .|.....t.%b..... 0030 e4 9c 02 e8 34 67 73 4e 73 d3 01 10 02 00 00 00 ....4gsNs....... 0040 00 00 00 00 00 6c 0d 00 00 38 00 00 00 01 00 00 .....l...8...... 0050 00 01 00 00 00 2c 01 01 00 01 00 00 00 24 00 01 .....,.......$.. 0060 00 00 80 01 00 07 80 0e 00 80 80 02 00 02 80 04 ................ 0070 00 02 80 03 00 01 80 0b 00 01 80 0c 70 80 00 00 ............p... 0080 00 18 40 48 b7 d5 6e bc e8 85 25 e7 de 7f 00 d6 ..@H..n...%..... 0090 c2 d3 c0 00 00 00 b8 04 33 4e ........3N Frame 3 (226 bytes on wire, 226 bytes captured) Arrival Time: Mar 22, 2004 14:06:39.828867000 Time delta from previous packet: 0.007419000 seconds Time since reference or first frame: 0.118714000 seconds Frame Number: 3 Packet Length: 226 bytes Capture Length: 226 bytes Ethernet II, Src: 00:0c:29:e6:ad:b9, Dst: 00:05:00:b8:00:e0 Destination: 00:05:00:b8:00:e0 (00:05:00:b8:00:e0) Source: 00:0c:29:e6:ad:b9 (00:0c:29:e6:ad:b9) Type: IP (0x0800) Frame check sequence: 0x69de864a (correct) Internet Protocol, Src Addr: 165.227.249.124 (165.227.249.124), Dst Addr: 165.227.249.126 (165.227.249.126) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 208 Identification: 0x0a98 (2712) Flags: 0x00 .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0x30c3 (correct) Source: 165.227.249.124 (165.227.249.124) Destination: 165.227.249.126 (165.227.249.126) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 188 Checksum: 0xade5 (correct) Internet Security Association and Key Management Protocol Initiator cookie: 0x62BB7FFD1B9CE49C Responder cookie: 0x02E83467734E73D3 Next payload: Key Exchange (4) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...0 = No encryption .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 180 Key Exchange payload Next payload: Nonce (10) Length: 132 Key Exchange Data Nonce payload Next payload: NONE (0) Length: 20 Nonce Data 0000 00 05 00 b8 00 e0 00 0c 29 e6 ad b9 08 00 45 00 ........).....E. 0010 00 d0 0a 98 00 00 40 11 30 c3 a5 e3 f9 7c a5 e3 ......@.0....|.. 0020 f9 7e 01 f4 01 f4 00 bc ad e5 62 bb 7f fd 1b 9c .~........b..... 0030 e4 9c 02 e8 34 67 73 4e 73 d3 04 10 02 00 00 00 ....4gsNs....... 0040 00 00 00 00 00 b4 0a 00 00 84 59 7a 20 c7 f5 7c ..........Yz ..| 0050 75 05 96 cc 9c 55 c7 e9 cd e0 27 b7 b7 8f 6e cb u....U....'...n. 0060 5c 9b e2 3c f2 2e 74 f7 73 ff 0f 88 c6 c6 54 21 \..<..t.s.....T! 0070 5d 6a ad f7 3d 79 4d 39 1d 54 3f 25 d8 68 ca 81 ]j..=yM9.T?%.h.. 0080 7b 41 52 58 5a 74 de 68 17 23 ec 6c 0e e3 09 de {ARXZt.h.#.l.... 0090 f8 d1 4b 73 39 f2 a5 47 ed 4d a9 12 90 23 83 e6 ..Ks9..G.M...#.. 00a0 32 1c d3 e2 6d 7e fd fe b2 d0 02 72 42 26 d8 9f 2...m~.....rB&.. 00b0 e4 7d 06 9e a6 f0 2c 62 51 85 88 7e fd d2 02 3a .}....,bQ..~...: 00c0 c0 da da de 23 0e 08 91 26 45 00 00 00 14 f9 28 ....#...&E.....( 00d0 f7 dc c9 1c 06 8e ef 24 9e 89 e9 d5 34 f3 69 de .......$....4.i. 00e0 86 4a .J Frame 4 (302 bytes on wire, 302 bytes captured) Arrival Time: Mar 22, 2004 14:06:39.952414000 Time delta from previous packet: 0.123547000 seconds Time since reference or first frame: 0.242261000 seconds Frame Number: 4 Packet Length: 302 bytes Capture Length: 302 bytes Ethernet II, Src: 00:05:00:b8:00:e0, Dst: 00:0c:29:e6:ad:b9 Destination: 00:0c:29:e6:ad:b9 (00:0c:29:e6:ad:b9) Source: 00:05:00:b8:00:e0 (00:05:00:b8:00:e0) Type: IP (0x0800) Frame check sequence: 0xafbfe7da (correct) Internet Protocol, Src Addr: 165.227.249.126 (165.227.249.126), Dst Addr: 165.227.249.124 (165.227.249.124) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 284 Identification: 0x0002 (2) Flags: 0x00 .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: UDP (0x11) Header checksum: 0xfb0c (correct) Source: 165.227.249.126 (165.227.249.126) Destination: 165.227.249.124 (165.227.249.124) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 264 Checksum: 0x0e51 (correct) Internet Security Association and Key Management Protocol Initiator cookie: 0x62BB7FFD1B9CE49C Responder cookie: 0x02E83467734E73D3 Next payload: Key Exchange (4) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...0 = No encryption .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 256 Key Exchange payload Next payload: Nonce (10) Length: 132 Key Exchange Data Nonce payload Next payload: Vendor ID (13) Length: 24 Nonce Data Vendor ID payload Next payload: Vendor ID (13) Length: 20 Vendor ID: unknown vendor ID: 0x12F5F28C457168A9702D9FE274CC0100 Vendor ID payload Next payload: Vendor ID (13) Length: 12 Vendor ID: draft-beaulieu-ike-xauth-02.txt Vendor ID payload Next payload: Vendor ID (13) Length: 20 Vendor ID: unknown vendor ID: 0xF72F937A734F73D35CE9FC21C2C88F6B Vendor ID payload Next payload: NONE (0) Length: 20 Vendor ID: unknown vendor ID: 0x1F07F70EAA6514D3B0FA96542A500400 0000 00 0c 29 e6 ad b9 00 05 00 b8 00 e0 08 00 45 00 ..)...........E. 0010 01 1c 00 02 00 00 80 11 fb 0c a5 e3 f9 7e a5 e3 .............~.. 0020 f9 7c 01 f4 01 f4 01 08 0e 51 62 bb 7f fd 1b 9c .|.......Qb..... 0030 e4 9c 02 e8 34 67 73 4e 73 d3 04 10 02 00 00 00 ....4gsNs....... 0040 00 00 00 00 01 00 0a 00 00 84 b3 9c 4f 3b 48 58 ............O;HX 0050 04 48 06 e4 8e 1f b2 9e 69 ac 3b ba d0 18 24 42 .H......i.;...$B 0060 13 9c af 89 89 8c de 47 c2 74 74 02 b3 a0 df c5 .......G.tt..... 0070 09 76 12 e2 e2 97 08 c5 fb 23 a3 8e aa d9 d4 46 .v.......#.....F 0080 e8 77 a7 5e f2 1f 68 64 30 a5 8d f4 a3 c9 6d 5a .w.^..hd0.....mZ 0090 e7 27 9d 49 e7 e5 dc 1c de be 9a 33 f5 2d 83 67 .'.I.......3.-.g 00a0 b4 3c 89 1b 73 ca 77 6e 34 40 d6 60 d5 8a c2 ee .<..s.wn4@.`.... 00b0 25 db 50 57 59 19 63 fc d4 0c bf a1 2b 04 06 71 %.PWY.c.....+..q 00c0 38 f9 ad f1 15 d0 0b 96 ff 67 0d 00 00 18 d3 ef 8........g...... 00d0 62 cb 57 1d dc 99 fc 5b 92 5f 52 fd e0 05 6d ad b.W....[._R...m. 00e0 58 a3 0d 00 00 14 12 f5 f2 8c 45 71 68 a9 70 2d X.........Eqh.p- 00f0 9f e2 74 cc 01 00 0d 00 00 0c 09 00 26 89 df d6 ..t.........&... 0100 b7 12 0d 00 00 14 f7 2f 93 7a 73 4f 73 d3 5c e9 ......./.zsOs.\. 0110 fc 21 c2 c8 8f 6b 00 00 00 14 1f 07 f7 0e aa 65 .!...k.........e 0120 14 d3 b0 fa 96 54 2a 50 04 00 af bf e7 da .....T*P...... Frame 5 (122 bytes on wire, 122 bytes captured) Arrival Time: Mar 22, 2004 14:06:39.959388000 Time delta from previous packet: 0.006974000 seconds Time since reference or first frame: 0.249235000 seconds Frame Number: 5 Packet Length: 122 bytes Capture Length: 122 bytes Ethernet II, Src: 00:0c:29:e6:ad:b9, Dst: 00:05:00:b8:00:e0 Destination: 00:05:00:b8:00:e0 (00:05:00:b8:00:e0) Source: 00:0c:29:e6:ad:b9 (00:0c:29:e6:ad:b9) Type: IP (0x0800) Frame check sequence: 0x512d2fea (correct) Internet Protocol, Src Addr: 165.227.249.124 (165.227.249.124), Dst Addr: 165.227.249.126 (165.227.249.126) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 104 Identification: 0x0a99 (2713) Flags: 0x00 .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0x312a (correct) Source: 165.227.249.124 (165.227.249.124) Destination: 165.227.249.126 (165.227.249.126) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 84 Checksum: 0x4d57 (correct) Internet Security Association and Key Management Protocol Initiator cookie: 0x62BB7FFD1B9CE49C Responder cookie: 0x02E83467734E73D3 Next payload: Identification (5) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...1 = Encryption .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 76 Encrypted payload (48 bytes) 0000 00 05 00 b8 00 e0 00 0c 29 e6 ad b9 08 00 45 00 ........).....E. 0010 00 68 0a 99 00 00 40 11 31 2a a5 e3 f9 7c a5 e3 .h....@.1*...|.. 0020 f9 7e 01 f4 01 f4 00 54 4d 57 62 bb 7f fd 1b 9c .~.....TMWb..... 0030 e4 9c 02 e8 34 67 73 4e 73 d3 05 10 02 01 00 00 ....4gsNs....... 0040 00 00 00 00 00 4c 3e 2c 7d 3b 92 b9 35 b5 36 72 .....L>,};..5.6r 0050 86 a2 1c ec 9f ac e4 e2 19 e6 ec 6a b1 b9 6c 89 ...........j..l. 0060 bc 1d 8e 0a 2a 26 76 34 b9 c9 15 58 49 33 d9 b6 ....*&v4...XI3.. 0070 44 dd 98 62 a5 ba 51 2d 2f ea D..b..Q-/. Frame 6 (138 bytes on wire, 138 bytes captured) Arrival Time: Mar 22, 2004 14:06:40.057890000 Time delta from previous packet: 0.098502000 seconds Time since reference or first frame: 0.347737000 seconds Frame Number: 6 Packet Length: 138 bytes Capture Length: 138 bytes Ethernet II, Src: 00:05:00:b8:00:e0, Dst: 00:0c:29:e6:ad:b9 Destination: 00:0c:29:e6:ad:b9 (00:0c:29:e6:ad:b9) Source: 00:05:00:b8:00:e0 (00:05:00:b8:00:e0) Type: IP (0x0800) Frame check sequence: 0x08870923 (correct) Internet Protocol, Src Addr: 165.227.249.126 (165.227.249.126), Dst Addr: 165.227.249.124 (165.227.249.124) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 120 Identification: 0x0003 (3) Flags: 0x00 .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: UDP (0x11) Header checksum: 0xfbaf (correct) Source: 165.227.249.126 (165.227.249.126) Destination: 165.227.249.124 (165.227.249.124) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 100 Checksum: 0x4926 (correct) Internet Security Association and Key Management Protocol Initiator cookie: 0x62BB7FFD1B9CE49C Responder cookie: 0x02E83467734E73D3 Next payload: Identification (5) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...1 = Encryption .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 92 Encrypted payload (64 bytes) 0000 00 0c 29 e6 ad b9 00 05 00 b8 00 e0 08 00 45 00 ..)...........E. 0010 00 78 00 03 00 00 80 11 fb af a5 e3 f9 7e a5 e3 .x...........~.. 0020 f9 7c 01 f4 01 f4 00 64 49 26 62 bb 7f fd 1b 9c .|.....dI&b..... 0030 e4 9c 02 e8 34 67 73 4e 73 d3 05 10 02 01 00 00 ....4gsNs....... 0040 00 00 00 00 00 5c de 59 90 da aa 12 ba d3 40 4c .....\.Y......@L 0050 c7 37 9a eb f4 7d 3b f5 f7 f2 c2 66 74 f4 a7 e3 .7...};....ft... 0060 b8 fe ba b9 f3 a1 d9 91 fd 00 e6 11 00 c2 97 2a ...............* 0070 90 60 9a d7 29 78 b6 89 bf 9f a4 c1 39 7f 4a 02 .`..)x......9.J. 0080 4d c8 63 b2 8b d2 08 87 09 23 M.c......# Frame 7 (346 bytes on wire, 346 bytes captured) Arrival Time: Mar 22, 2004 14:06:40.067643000 Time delta from previous packet: 0.009753000 seconds Time since reference or first frame: 0.357490000 seconds Frame Number: 7 Packet Length: 346 bytes Capture Length: 346 bytes Ethernet II, Src: 00:0c:29:e6:ad:b9, Dst: 00:05:00:b8:00:e0 Destination: 00:05:00:b8:00:e0 (00:05:00:b8:00:e0) Source: 00:0c:29:e6:ad:b9 (00:0c:29:e6:ad:b9) Type: IP (0x0800) Frame check sequence: 0x0f87d229 (correct) Internet Protocol, Src Addr: 165.227.249.124 (165.227.249.124), Dst Addr: 165.227.249.126 (165.227.249.126) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 328 Identification: 0x0a9a (2714) Flags: 0x00 .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0x3049 (correct) Source: 165.227.249.124 (165.227.249.124) Destination: 165.227.249.126 (165.227.249.126) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 308 Checksum: 0xc084 (correct) Internet Security Association and Key Management Protocol Initiator cookie: 0x62BB7FFD1B9CE49C Responder cookie: 0x02E83467734E73D3 Next payload: Hash (8) Version: 1.0 Exchange type: Quick Mode (32) Flags .... ...1 = Encryption .... ..0. = No commit .... .0.. = No authentication Message ID: 0x16274151 Length: 300 Encrypted payload (272 bytes) 0000 00 05 00 b8 00 e0 00 0c 29 e6 ad b9 08 00 45 00 ........).....E. 0010 01 48 0a 9a 00 00 40 11 30 49 a5 e3 f9 7c a5 e3 .H....@.0I...|.. 0020 f9 7e 01 f4 01 f4 01 34 c0 84 62 bb 7f fd 1b 9c .~.....4..b..... 0030 e4 9c 02 e8 34 67 73 4e 73 d3 08 10 20 01 16 27 ....4gsNs... ..' 0040 41 51 00 00 01 2c 12 1d f9 92 43 a7 9f f0 06 87 AQ...,....C..... 0050 67 54 32 60 1b 35 00 05 b7 b5 bb 7d 80 f3 d6 9e gT2`.5.....}.... 0060 99 39 2c 17 71 bb 18 2b 1d a6 8b fd bb 16 95 a7 .9,.q..+........ 0070 6c 54 91 d1 ff 3e 19 ad fd 28 80 e0 fc bc 49 3f lT...>...(....I? 0080 a7 72 cb 9e 6e 2e 6d 8a eb 2f 6d ee 39 ef df 04 .r..n.m../m.9... 0090 ab b2 8b f1 8b 98 74 79 f1 be 29 70 0b 8f 34 70 ......ty..)p..4p 00a0 48 3e 53 c2 7a 2d 20 f2 2e c7 71 6c 9d c9 17 59 H>S.z- ...ql...Y 00b0 4f 6a c4 df cc c6 2c cc 5c 20 6c fe 2f 8b 2e 5d Oj....,.\ l./..] 00c0 89 9e 19 a7 5d 10 01 13 67 2f 2e 0a cf a3 93 6f ....]...g/.....o 00d0 5b c5 a7 7a 6c 06 72 34 cb 9f 4a a0 48 32 d3 cf [..zl.r4..J.H2.. 00e0 83 0b 7c 70 4f 66 36 42 4d d8 b2 be 4d fd ff 6e ..|pOf6BM...M..n 00f0 22 80 dd e7 8a 8a 30 8c c1 97 11 19 5e c6 ce 17 ".....0.....^... 0100 fa d5 93 a4 ae df c1 82 69 af 5e 71 d3 8e 70 e8 ........i.^q..p. 0110 e0 a1 38 d6 dd 9f 91 80 98 fa 27 5b a7 0e c2 11 ..8.......'[.... 0120 3d 3b 6e 78 af af dc df be ed 16 ef a9 32 cb 1e =;nx.........2.. 0130 8f cf d5 e5 ee 35 6c 50 47 98 ee 54 9a 67 22 b1 .....5lPG..T.g". 0140 ca c6 4d 17 a7 1a c2 56 5d de f6 45 82 e7 25 0c ..M....V]..E..%. 0150 0b 27 22 9f 8e e0 0f 87 d2 29 .'"......) Frame 8 (346 bytes on wire, 346 bytes captured) Arrival Time: Mar 22, 2004 14:06:40.292647000 Time delta from previous packet: 0.225004000 seconds Time since reference or first frame: 0.582494000 seconds Frame Number: 8 Packet Length: 346 bytes Capture Length: 346 bytes Ethernet II, Src: 00:05:00:b8:00:e0, Dst: 00:0c:29:e6:ad:b9 Destination: 00:0c:29:e6:ad:b9 (00:0c:29:e6:ad:b9) Source: 00:05:00:b8:00:e0 (00:05:00:b8:00:e0) Type: IP (0x0800) Frame check sequence: 0x9326db34 (correct) Internet Protocol, Src Addr: 165.227.249.126 (165.227.249.126), Dst Addr: 165.227.249.124 (165.227.249.124) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 328 Identification: 0x0004 (4) Flags: 0x00 .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: UDP (0x11) Header checksum: 0xfade (correct) Source: 165.227.249.126 (165.227.249.126) Destination: 165.227.249.124 (165.227.249.124) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 308 Checksum: 0xa516 (correct) Internet Security Association and Key Management Protocol Initiator cookie: 0x62BB7FFD1B9CE49C Responder cookie: 0x02E83467734E73D3 Next payload: Hash (8) Version: 1.0 Exchange type: Quick Mode (32) Flags .... ...1 = Encryption .... ..0. = No commit .... .0.. = No authentication Message ID: 0x16274151 Length: 300 Encrypted payload (272 bytes) 0000 00 0c 29 e6 ad b9 00 05 00 b8 00 e0 08 00 45 00 ..)...........E. 0010 01 48 00 04 00 00 80 11 fa de a5 e3 f9 7e a5 e3 .H...........~.. 0020 f9 7c 01 f4 01 f4 01 34 a5 16 62 bb 7f fd 1b 9c .|.....4..b..... 0030 e4 9c 02 e8 34 67 73 4e 73 d3 08 10 20 01 16 27 ....4gsNs... ..' 0040 41 51 00 00 01 2c a7 f5 95 8a 63 69 11 fa 55 b3 AQ...,....ci..U. 0050 33 c1 17 60 e2 60 52 72 8d b0 f2 5b b8 91 49 77 3..`.`Rr...[..Iw 0060 56 a8 32 c3 00 89 86 5f 9d 4f 32 00 aa 91 df c4 V.2...._.O2..... 0070 9c 07 3c ff d0 11 45 d1 d6 37 3b 68 d2 2a 93 c1 ..<...E..7;h.*.. 0080 2b ff 2f 94 2b 61 4f 65 fc 6f c8 6e a0 87 c6 20 +./.+aOe.o.n... 0090 c1 ad 74 34 02 fd 16 4c 74 e7 8a 28 2d 12 e1 ea ..t4...Lt..(-... 00a0 5d 49 2d b7 a3 9f 6d 3e 90 4a a5 67 ca d4 ca 86 ]I-...m>.J.g.... 00b0 2a a5 bd 47 75 ff 8e 83 f0 8d d5 50 64 69 b9 db *..Gu......Pdi.. 00c0 5c b0 d9 80 fd 34 75 fe 94 eb b9 79 0f 9e de 26 \....4u....y...& 00d0 7c cb fd 96 3a 99 d9 b6 fa c7 2b 07 bb 61 79 48 |...:.....+..ayH 00e0 c8 b9 64 af 84 25 61 82 2d 68 c7 f9 b5 15 67 56 ..d..%a.-h....gV 00f0 ee 92 53 3f e5 c9 46 1c 46 ac c1 5b b0 12 82 71 ..S?..F.F..[...q 0100 e4 f0 a3 37 46 31 78 91 b6 b3 4f 4a 35 a7 e7 32 ...7F1x...OJ5..2 0110 05 3e f2 18 95 e9 b0 7d a8 1d 29 5c bb 14 b5 eb .>.....}..)\.... 0120 b9 30 72 e7 53 0a 05 85 f5 81 d0 b8 05 bd 63 eb .0r.S.........c. 0130 1a 28 42 a6 2b 45 1d 9c 01 3d 88 49 68 60 05 a2 .(B.+E...=.Ih`.. 0140 7e f5 38 c7 45 e2 c1 c5 b7 cd f1 7a 77 89 5d 2c ~.8.E......zw.], 0150 9a 59 aa 18 c8 8d 93 26 db 34 .Y.....&.4 Frame 9 (106 bytes on wire, 106 bytes captured) Arrival Time: Mar 22, 2004 14:06:40.302061000 Time delta from previous packet: 0.009414000 seconds Time since reference or first frame: 0.591908000 seconds Frame Number: 9 Packet Length: 106 bytes Capture Length: 106 bytes Ethernet II, Src: 00:0c:29:e6:ad:b9, Dst: 00:05:00:b8:00:e0 Destination: 00:05:00:b8:00:e0 (00:05:00:b8:00:e0) Source: 00:0c:29:e6:ad:b9 (00:0c:29:e6:ad:b9) Type: IP (0x0800) Frame check sequence: 0x479388b8 (correct) Internet Protocol, Src Addr: 165.227.249.124 (165.227.249.124), Dst Addr: 165.227.249.126 (165.227.249.126) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 88 Identification: 0x0a9b (2715) Flags: 0x00 .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0x3138 (correct) Source: 165.227.249.124 (165.227.249.124) Destination: 165.227.249.126 (165.227.249.126) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 68 Checksum: 0xbe9a (correct) Internet Security Association and Key Management Protocol Initiator cookie: 0x62BB7FFD1B9CE49C Responder cookie: 0x02E83467734E73D3 Next payload: Hash (8) Version: 1.0 Exchange type: Quick Mode (32) Flags .... ...1 = Encryption .... ..0. = No commit .... .0.. = No authentication Message ID: 0x16274151 Length: 60 Encrypted payload (32 bytes) 0000 00 05 00 b8 00 e0 00 0c 29 e6 ad b9 08 00 45 00 ........).....E. 0010 00 58 0a 9b 00 00 40 11 31 38 a5 e3 f9 7c a5 e3 .X....@.18...|.. 0020 f9 7e 01 f4 01 f4 00 44 be 9a 62 bb 7f fd 1b 9c .~.....D..b..... 0030 e4 9c 02 e8 34 67 73 4e 73 d3 08 10 20 01 16 27 ....4gsNs... ..' 0040 41 51 00 00 00 3c 78 60 f2 14 04 48 dc d6 ac 46 AQ........"u.....E 0050 74 7a b0 c0 72 ad 32 2b cf 7e ad a2 f6 91 e7 a6 tz..r.2+.~...... 0060 63 f6 8c ea ca 2c 2c c6 67 90 9a 07 0b af f6 3d c....,,.g......= 0070 35 4a f9 d3 02 0b 50 6d 0d c8 a2 70 ef 34 d5 38 5J....Pm...p.4.8 0080 ef b9 26 19 b0 57 62 44 6f 4b ec 90 32 8d f0 14 ..&..WbDoK..2... 0090 98 e1 a0 7e 36 aa a5 69 77 58 fa 01 a9 0b 9a 4e ...~6..iwX.....N 00a0 03 8e 25 93 dd e2 9e 87 8e 59 ..%......Y Frame 11 (170 bytes on wire, 170 bytes captured) Arrival Time: Mar 22, 2004 14:06:40.566868000 Time delta from previous packet: 0.001974000 seconds Time since reference or first frame: 0.856715000 seconds Frame Number: 11 Packet Length: 170 bytes Capture Length: 170 bytes Ethernet II, Src: 00:05:00:b8:00:e0, Dst: 00:0c:29:e6:ad:b9 Destination: 00:0c:29:e6:ad:b9 (00:0c:29:e6:ad:b9) Source: 00:05:00:b8:00:e0 (00:05:00:b8:00:e0) Type: IP (0x0800) Frame check sequence: 0x0af4cab9 (correct) Internet Protocol, Src Addr: 165.227.249.126 (165.227.249.126), Dst Addr: 165.227.249.124 (165.227.249.124) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 152 Identification: 0x0001 (1) Flags: 0x00 .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: ESP (0x32) Header checksum: 0x3b71 (correct) Source: 165.227.249.126 (165.227.249.126) Destination: 165.227.249.124 (165.227.249.124) Encapsulating Security Payload SPI: 0xecb5396c Sequence: 1 Data (124 bytes) 0000 00 0c 29 e6 ad b9 00 05 00 b8 00 e0 08 00 45 00 ..)...........E. 0010 00 98 00 01 00 00 40 32 3b 71 a5 e3 f9 7e a5 e3 ......@2;q...~.. 0020 f9 7c ec b5 39 6c 00 00 00 01 84 fb 1e c5 04 45 .|..9l.........E 0030 aa ae ac 23 71 dd 6b e7 28 09 bb 1b f0 c8 69 63 ...#q.k.(.....ic 0040 e1 b5 b5 2f e5 2d a1 f3 d6 62 a2 8d 16 03 5f 8b .../.-...b...._. 0050 5b 54 37 a2 63 e0 92 23 6a 34 b1 b2 c3 fb bb c5 [T7.c..#j4...... 0060 d6 20 29 40 68 84 76 ea 8a 5b 8f 99 45 64 35 fb . )@h.v..[..Ed5. 0070 98 62 5a ce 6d cc 5c 12 27 1c 4e a5 8e 18 0c 59 .bZ.m.\.'.N....Y 0080 d9 6f ea 0e d8 08 83 47 ea 78 e2 af 87 c2 a8 1d .o.....G.x...... 0090 f4 56 c9 d7 8d 89 7d a0 e5 d4 b9 a3 57 eb 7e 83 .V....}.....W.~. 00a0 56 e4 ad 18 63 81 0a f4 ca b9 V...c..... Frame 12 (170 bytes on wire, 170 bytes captured) Arrival Time: Mar 22, 2004 14:06:40.718649000 Time delta from previous packet: 0.151781000 seconds Time since reference or first frame: 1.008496000 seconds Frame Number: 12 Packet Length: 170 bytes Capture Length: 170 bytes Ethernet II, Src: 00:0c:29:e6:ad:b9, Dst: 00:05:00:b8:00:e0 Destination: 00:05:00:b8:00:e0 (00:05:00:b8:00:e0) Source: 00:0c:29:e6:ad:b9 (00:0c:29:e6:ad:b9) Type: IP (0x0800) Frame check sequence: 0x774619b9 (correct) Internet Protocol, Src Addr: 165.227.249.124 (165.227.249.124), Dst Addr: 165.227.249.126 (165.227.249.126) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 152 Identification: 0x0012 (18) Flags: 0x00 .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 240 Protocol: ESP (0x32) Header checksum: 0x8b5f (correct) Source: 165.227.249.124 (165.227.249.124) Destination: 165.227.249.126 (165.227.249.126) Encapsulating Security Payload SPI: 0x038647a8 Sequence: 3 Data (124 bytes) 0000 00 05 00 b8 00 e0 00 0c 29 e6 ad b9 08 00 45 00 ........).....E. 0010 00 98 00 12 00 00 f0 32 8b 5f a5 e3 f9 7c a5 e3 .......2._...|.. 0020 f9 7e 03 86 47 a8 00 00 00 03 4a 32 5a 08 ac 3f .~..G.....J2Z..? 0030 2b 56 2a 30 d0 f9 0a 14 1d 5f 25 91 9c 04 3a 84 +V*0....._%...:. 0040 93 93 c9 b6 d7 e6 53 77 b2 07 70 ad 69 af 87 0b ......Sw..p.i... 0050 6f 52 ef 9b 4e 84 43 f5 d9 8c 6b da 9c 0a 00 20 oR..N.C...k.... 0060 6d a6 78 a2 de 9b 4b 7d 1f 7c 97 4b 34 5e 67 0f m.x...K}.|.K4^g. 0070 5d bb 42 c8 a2 7f fc fc c7 45 08 0c 2d 1a 55 64 ].B......E..-.Ud 0080 e0 0b 82 c7 54 db e3 20 7b 97 84 4a 74 a3 7d ec ....T.. {..Jt.}. 0090 eb 39 5f 4a 34 b3 7a 94 f3 b5 94 5a b2 1d 71 d2 .9_J4.z....Z..q. 00a0 88 b2 f5 38 c1 20 77 46 19 b9 ...8. wF.. Frame 13 (170 bytes on wire, 170 bytes captured) Arrival Time: Mar 22, 2004 14:06:40.719403000 Time delta from previous packet: 0.000754000 seconds Time since reference or first frame: 1.009250000 seconds Frame Number: 13 Packet Length: 170 bytes Capture Length: 170 bytes Ethernet II, Src: 00:05:00:b8:00:e0, Dst: 00:0c:29:e6:ad:b9 Destination: 00:0c:29:e6:ad:b9 (00:0c:29:e6:ad:b9) Source: 00:05:00:b8:00:e0 (00:05:00:b8:00:e0) Type: IP (0x0800) Frame check sequence: 0x9d23da33 (correct) Internet Protocol, Src Addr: 165.227.249.126 (165.227.249.126), Dst Addr: 165.227.249.124 (165.227.249.124) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 152 Identification: 0x0002 (2) Flags: 0x00 .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: ESP (0x32) Header checksum: 0x3b70 (correct) Source: 165.227.249.126 (165.227.249.126) Destination: 165.227.249.124 (165.227.249.124) Encapsulating Security Payload SPI: 0xecb5396c Sequence: 2 Data (124 bytes) 0000 00 0c 29 e6 ad b9 00 05 00 b8 00 e0 08 00 45 00 ..)...........E. 0010 00 98 00 02 00 00 40 32 3b 70 a5 e3 f9 7e a5 e3 ......@2;p...~.. 0020 f9 7c ec b5 39 6c 00 00 00 02 e2 af 87 c2 a8 1d .|..9l.......... 0030 f4 56 c9 d7 8d 89 7d a0 e5 d4 cc 7f 03 7d b2 da .V....}......}.. 0040 2b 5f 0e 24 8c c8 47 7c a3 0a fb 63 f6 48 05 02 +_.$..G|...c.H.. 0050 c6 e8 56 0d 6c 48 d3 5d 3c 79 95 da c8 14 b5 0a ..V.lH.] 0050 7f 12 32 86 d7 29 56 dd 9e c1 5f be 36 b7 bc ca ..2..)V..._.6... 0060 35 38 a2 8b 45 5a 3c d6 af 46 ee 56 e5 85 c6 ff 58..EZ<..F.V.... 0070 c9 04 70 c3 da cb 82 af b4 d0 69 86 df 7e 87 f9 ..p.......i..~.. 0080 1d 42 73 c1 77 d5 2c 50 32 23 68 3e 89 83 f6 8b .Bs.w.,P2#h>.... 0090 d3 49 b9 9b c4 6e a3 c8 64 c9 5f 17 af 2b 2b 8a .I...n..d._..++. 00a0 6d 99 50 f9 54 0a 13 67 eb 33 m.P.T..g.3