Frame 1 (326 bytes on wire, 326 bytes captured) Arrival Time: May 27, 2009 16:27:53.021884000 [Time delta from previous captured frame: 0.000000000 seconds] [Time delta from previous displayed frame: 0.000000000 seconds] [Time since reference or first frame: 0.000000000 seconds] Frame Number: 1 Frame Length: 326 bytes Capture Length: 326 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f), Dst: 00:24:b2:31:e1:3d (00:24:b2:31:e1:3d) Destination: 00:24:b2:31:e1:3d (00:24:b2:31:e1:3d) Address: 00:24:b2:31:e1:3d (00:24:b2:31:e1:3d) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) Address: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.124 (165.227.249.124), Dst: 165.227.249.138 (165.227.249.138) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 312 Identification: 0x0000 (0) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfae6 [correct] [Good: True] [Bad : False] Source: 165.227.249.124 (165.227.249.124) Destination: 165.227.249.138 (165.227.249.138) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 292 Checksum: 0xbe34 [correct] [Good Checksum: True] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: A3E7FFD2999E6D49 Responder cookie: 0000000000000000 Next payload: Security Association (1) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags: 0x00 .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 284 Security Association payload Next payload: Vendor ID (13) Payload length: 136 Domain of interpretation: IPSEC (1) Situation: IDENTITY (1) Proposal payload # 0 Next payload: NONE (0) Payload length: 124 Proposal number: 0 Protocol ID: ISAKMP (1) SPI Size: 8 Proposal transforms: 3 SPI: 0xA3E7FFD2999E6D49 Transform payload # 0 Next payload: Transform (3) Payload length: 36 Transform number: 0 Transform ID: KEY_IKE (1) Encryption-Algorithm (1): AES-CBC (7) Key-Length (14): Key-Length (128) Hash-Algorithm (2): SHA (2) Authentication-Method (3): PSK (1) Group-Description (4): Alternate 1024-bit MODP group (2) Life-Type (11): Seconds (1) Life-Duration (12): Duration-Value (28800) Transform payload # 1 Next payload: Transform (3) Payload length: 36 Transform number: 1 Transform ID: KEY_IKE (1) Encryption-Algorithm (1): AES-CBC (7) Key-Length (14): Key-Length (192) Hash-Algorithm (2): SHA (2) Authentication-Method (3): PSK (1) Group-Description (4): Alternate 1024-bit MODP group (2) Life-Type (11): Seconds (1) Life-Duration (12): Duration-Value (28800) Transform payload # 2 Next payload: NONE (0) Payload length: 36 Transform number: 2 Transform ID: KEY_IKE (1) Encryption-Algorithm (1): AES-CBC (7) Key-Length (14): Key-Length (256) Hash-Algorithm (2): SHA (2) Authentication-Method (3): PSK (1) Group-Description (4): Alternate 1024-bit MODP group (2) Life-Type (11): Seconds (1) Life-Duration (12): Duration-Value (28800) Vendor ID: F758F22668750F03B08DF6EBE1D00403 Next payload: Vendor ID (13) Payload length: 20 Vendor ID: F758F22668750F03B08DF6EBE1D00403 Vendor ID: draft-ietf-ipsec-nat-t-ike-02 Next payload: Vendor ID (13) Payload length: 20 Vendor ID: draft-ietf-ipsec-nat-t-ike-02 Vendor ID: draft-ietf-ipsec-nat-t-ike-02\n Next payload: Vendor ID (13) Payload length: 20 Vendor ID: draft-ietf-ipsec-nat-t-ike-02\n Vendor ID: draft-ietf-ipsec-nat-t-ike-03 Next payload: Vendor ID (13) Payload length: 20 Vendor ID: draft-ietf-ipsec-nat-t-ike-03 Vendor ID: RFC 3947 Negotiation of NAT-Traversal in the IKE Next payload: Vendor ID (13) Payload length: 20 Vendor ID: RFC 3947 Negotiation of NAT-Traversal in the IKE Vendor ID: RFC 3706 Detecting Dead IKE Peers (DPD) Next payload: NONE (0) Payload length: 20 Vendor ID: RFC 3706 Detecting Dead IKE Peers (DPD) 0000 00 24 b2 31 e1 3d 00 0c 29 48 f8 2f 08 00 45 00 .$.1.=..)H./..E. 0010 01 38 00 00 40 00 40 11 fa e6 a5 e3 f9 7c a5 e3 .8..@.@......|.. 0020 f9 8a 01 f4 01 f4 01 24 be 34 a3 e7 ff d2 99 9e .......$.4...... 0030 6d 49 00 00 00 00 00 00 00 00 01 10 02 00 00 00 mI.............. 0040 00 00 00 00 01 1c 0d 00 00 88 00 00 00 01 00 00 ................ 0050 00 01 00 00 00 7c 00 01 08 03 a3 e7 ff d2 99 9e .....|.......... 0060 6d 49 03 00 00 24 00 01 00 00 80 01 00 07 80 0e mI...$.......... 0070 00 80 80 02 00 02 80 03 00 01 80 04 00 02 80 0b ................ 0080 00 01 80 0c 70 80 03 00 00 24 01 01 00 00 80 01 ....p....$...... 0090 00 07 80 0e 00 c0 80 02 00 02 80 03 00 01 80 04 ................ 00a0 00 02 80 0b 00 01 80 0c 70 80 00 00 00 24 02 01 ........p....$.. 00b0 00 00 80 01 00 07 80 0e 01 00 80 02 00 02 80 03 ................ 00c0 00 01 80 04 00 02 80 0b 00 01 80 0c 70 80 0d 00 ............p... 00d0 00 14 f7 58 f2 26 68 75 0f 03 b0 8d f6 eb e1 d0 ...X.&hu........ 00e0 04 03 0d 00 00 14 cd 60 46 43 35 df 21 f8 7c fd .......`FC5.!.|. 00f0 b2 fc 68 b6 a4 48 0d 00 00 14 90 cb 80 91 3e bb ..h..H........>. 0100 69 6e 08 63 81 b5 ec 42 7b 1f 0d 00 00 14 7d 94 in.c...B{.....}. 0110 19 a6 53 10 ca 6f 2c 17 9d 92 15 52 9d 56 0d 00 ..S..o,....R.V.. 0120 00 14 4a 13 1c 81 07 03 58 45 5c 57 28 f2 0e 95 ..J.....XE\W(... 0130 45 2f 00 00 00 14 af ca d7 13 68 a1 f1 c9 6b 86 E/........h...k. 0140 96 fc 77 57 01 00 ..wW.. Frame 2 (326 bytes on wire, 326 bytes captured) Arrival Time: May 27, 2009 16:27:53.021946000 [Time delta from previous captured frame: 0.000062000 seconds] [Time delta from previous displayed frame: 0.000062000 seconds] [Time since reference or first frame: 0.000062000 seconds] Frame Number: 2 Frame Length: 326 bytes Capture Length: 326 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f), Dst: 00:24:b2:31:e1:3d (00:24:b2:31:e1:3d) Destination: 00:24:b2:31:e1:3d (00:24:b2:31:e1:3d) Address: 00:24:b2:31:e1:3d (00:24:b2:31:e1:3d) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) Address: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.124 (165.227.249.124), Dst: 165.227.249.138 (165.227.249.138) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 312 Identification: 0x0000 (0) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfae6 [correct] [Good: True] [Bad : False] Source: 165.227.249.124 (165.227.249.124) Destination: 165.227.249.138 (165.227.249.138) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 292 Checksum: 0xbe34 [correct] [Good Checksum: True] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: A3E7FFD2999E6D49 Responder cookie: 0000000000000000 Next payload: Security Association (1) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags: 0x00 .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 284 Security Association payload Next payload: Vendor ID (13) Payload length: 136 Domain of interpretation: IPSEC (1) Situation: IDENTITY (1) Proposal payload # 0 Next payload: NONE (0) Payload length: 124 Proposal number: 0 Protocol ID: ISAKMP (1) SPI Size: 8 Proposal transforms: 3 SPI: 0xA3E7FFD2999E6D49 Transform payload # 0 Next payload: Transform (3) Payload length: 36 Transform number: 0 Transform ID: KEY_IKE (1) Encryption-Algorithm (1): AES-CBC (7) Key-Length (14): Key-Length (128) Hash-Algorithm (2): SHA (2) Authentication-Method (3): PSK (1) Group-Description (4): Alternate 1024-bit MODP group (2) Life-Type (11): Seconds (1) Life-Duration (12): Duration-Value (28800) Transform payload # 1 Next payload: Transform (3) Payload length: 36 Transform number: 1 Transform ID: KEY_IKE (1) Encryption-Algorithm (1): AES-CBC (7) Key-Length (14): Key-Length (192) Hash-Algorithm (2): SHA (2) Authentication-Method (3): PSK (1) Group-Description (4): Alternate 1024-bit MODP group (2) Life-Type (11): Seconds (1) Life-Duration (12): Duration-Value (28800) Transform payload # 2 Next payload: NONE (0) Payload length: 36 Transform number: 2 Transform ID: KEY_IKE (1) Encryption-Algorithm (1): AES-CBC (7) Key-Length (14): Key-Length (256) Hash-Algorithm (2): SHA (2) Authentication-Method (3): PSK (1) Group-Description (4): Alternate 1024-bit MODP group (2) Life-Type (11): Seconds (1) Life-Duration (12): Duration-Value (28800) Vendor ID: F758F22668750F03B08DF6EBE1D00403 Next payload: Vendor ID (13) Payload length: 20 Vendor ID: F758F22668750F03B08DF6EBE1D00403 Vendor ID: draft-ietf-ipsec-nat-t-ike-02 Next payload: Vendor ID (13) Payload length: 20 Vendor ID: draft-ietf-ipsec-nat-t-ike-02 Vendor ID: draft-ietf-ipsec-nat-t-ike-02\n Next payload: Vendor ID (13) Payload length: 20 Vendor ID: draft-ietf-ipsec-nat-t-ike-02\n Vendor ID: draft-ietf-ipsec-nat-t-ike-03 Next payload: Vendor ID (13) Payload length: 20 Vendor ID: draft-ietf-ipsec-nat-t-ike-03 Vendor ID: RFC 3947 Negotiation of NAT-Traversal in the IKE Next payload: Vendor ID (13) Payload length: 20 Vendor ID: RFC 3947 Negotiation of NAT-Traversal in the IKE Vendor ID: RFC 3706 Detecting Dead IKE Peers (DPD) Next payload: NONE (0) Payload length: 20 Vendor ID: RFC 3706 Detecting Dead IKE Peers (DPD) 0000 00 24 b2 31 e1 3d 00 0c 29 48 f8 2f 08 00 45 00 .$.1.=..)H./..E. 0010 01 38 00 00 40 00 40 11 fa e6 a5 e3 f9 7c a5 e3 .8..@.@......|.. 0020 f9 8a 01 f4 01 f4 01 24 be 34 a3 e7 ff d2 99 9e .......$.4...... 0030 6d 49 00 00 00 00 00 00 00 00 01 10 02 00 00 00 mI.............. 0040 00 00 00 00 01 1c 0d 00 00 88 00 00 00 01 00 00 ................ 0050 00 01 00 00 00 7c 00 01 08 03 a3 e7 ff d2 99 9e .....|.......... 0060 6d 49 03 00 00 24 00 01 00 00 80 01 00 07 80 0e mI...$.......... 0070 00 80 80 02 00 02 80 03 00 01 80 04 00 02 80 0b ................ 0080 00 01 80 0c 70 80 03 00 00 24 01 01 00 00 80 01 ....p....$...... 0090 00 07 80 0e 00 c0 80 02 00 02 80 03 00 01 80 04 ................ 00a0 00 02 80 0b 00 01 80 0c 70 80 00 00 00 24 02 01 ........p....$.. 00b0 00 00 80 01 00 07 80 0e 01 00 80 02 00 02 80 03 ................ 00c0 00 01 80 04 00 02 80 0b 00 01 80 0c 70 80 0d 00 ............p... 00d0 00 14 f7 58 f2 26 68 75 0f 03 b0 8d f6 eb e1 d0 ...X.&hu........ 00e0 04 03 0d 00 00 14 cd 60 46 43 35 df 21 f8 7c fd .......`FC5.!.|. 00f0 b2 fc 68 b6 a4 48 0d 00 00 14 90 cb 80 91 3e bb ..h..H........>. 0100 69 6e 08 63 81 b5 ec 42 7b 1f 0d 00 00 14 7d 94 in.c...B{.....}. 0110 19 a6 53 10 ca 6f 2c 17 9d 92 15 52 9d 56 0d 00 ..S..o,....R.V.. 0120 00 14 4a 13 1c 81 07 03 58 45 5c 57 28 f2 0e 95 ..J.....XE\W(... 0130 45 2f 00 00 00 14 af ca d7 13 68 a1 f1 c9 6b 86 E/........h...k. 0140 96 fc 77 57 01 00 ..wW.. Frame 3 (174 bytes on wire, 174 bytes captured) Arrival Time: May 27, 2009 16:27:53.293661000 [Time delta from previous captured frame: 0.271715000 seconds] [Time delta from previous displayed frame: 0.271715000 seconds] [Time since reference or first frame: 0.271777000 seconds] Frame Number: 3 Frame Length: 174 bytes Capture Length: 174 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:24:b2:31:e1:3d (00:24:b2:31:e1:3d), Dst: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) Destination: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) Address: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:24:b2:31:e1:3d (00:24:b2:31:e1:3d) Address: 00:24:b2:31:e1:3d (00:24:b2:31:e1:3d) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.138 (165.227.249.138), Dst: 165.227.249.124 (165.227.249.124) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 160 Identification: 0x0000 (0) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfb7e [correct] [Good: True] [Bad : False] Source: 165.227.249.138 (165.227.249.138) Destination: 165.227.249.124 (165.227.249.124) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 140 Checksum: 0x3cc2 [correct] [Good Checksum: True] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: A3E7FFD2999E6D49 Responder cookie: 97EC59F7B4DA8D38 Next payload: Security Association (1) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags: 0x00 .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 132 Security Association payload Next payload: Vendor ID (13) Payload length: 64 Domain of interpretation: IPSEC (1) Situation: IDENTITY (1) Proposal payload # 0 Next payload: NONE (0) Payload length: 52 Proposal number: 0 Protocol ID: ISAKMP (1) SPI Size: 8 Proposal transforms: 1 SPI: 0x0000000000000000 Transform payload # 0 Next payload: NONE (0) Payload length: 36 Transform number: 0 Transform ID: KEY_IKE (1) Encryption-Algorithm (1): AES-CBC (7) Key-Length (14): Key-Length (128) Hash-Algorithm (2): SHA (2) Authentication-Method (3): PSK (1) Group-Description (4): Alternate 1024-bit MODP group (2) Life-Type (11): Seconds (1) Life-Duration (12): Duration-Value (28800) Vendor ID: 3B9031DCE4FCF88B489A923963DD0C49 Next payload: Vendor ID (13) Payload length: 20 Vendor ID: 3B9031DCE4FCF88B489A923963DD0C49 Vendor ID: 7003CBC1097DBE9C2600BA6983BC8B35 Next payload: NONE (0) Payload length: 20 Vendor ID: 7003CBC1097DBE9C2600BA6983BC8B35 0000 00 0c 29 48 f8 2f 00 24 b2 31 e1 3d 08 00 45 00 ..)H./.$.1.=..E. 0010 00 a0 00 00 40 00 40 11 fb 7e a5 e3 f9 8a a5 e3 ....@.@..~...... 0020 f9 7c 01 f4 01 f4 00 8c 3c c2 a3 e7 ff d2 99 9e .|......<....... 0030 6d 49 97 ec 59 f7 b4 da 8d 38 01 10 02 00 00 00 mI..Y....8...... 0040 00 00 00 00 00 84 0d 00 00 40 00 00 00 01 00 00 .........@...... 0050 00 01 00 00 00 34 00 01 08 01 00 00 00 00 00 00 .....4.......... 0060 00 00 00 00 00 24 00 01 00 00 80 01 00 07 80 0e .....$.......... 0070 00 80 80 02 00 02 80 03 00 01 80 04 00 02 80 0b ................ 0080 00 01 80 0c 70 80 0d 00 00 14 3b 90 31 dc e4 fc ....p.....;.1... 0090 f8 8b 48 9a 92 39 63 dd 0c 49 00 00 00 14 70 03 ..H..9c..I....p. 00a0 cb c1 09 7d be 9c 26 00 ba 69 83 bc 8b 35 ...}..&..i...5 Frame 4 (222 bytes on wire, 222 bytes captured) Arrival Time: May 27, 2009 16:27:53.300057000 [Time delta from previous captured frame: 0.006396000 seconds] [Time delta from previous displayed frame: 0.006396000 seconds] [Time since reference or first frame: 0.278173000 seconds] Frame Number: 4 Frame Length: 222 bytes Capture Length: 222 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f), Dst: 00:24:b2:31:e1:3d (00:24:b2:31:e1:3d) Destination: 00:24:b2:31:e1:3d (00:24:b2:31:e1:3d) Address: 00:24:b2:31:e1:3d (00:24:b2:31:e1:3d) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) Address: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.124 (165.227.249.124), Dst: 165.227.249.138 (165.227.249.138) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 208 Identification: 0x0000 (0) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfb4e [correct] [Good: True] [Bad : False] Source: 165.227.249.124 (165.227.249.124) Destination: 165.227.249.138 (165.227.249.138) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 188 Checksum: 0xaa37 [correct] [Good Checksum: True] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: A3E7FFD2999E6D49 Responder cookie: 97EC59F7B4DA8D38 Next payload: Key Exchange (4) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags: 0x00 .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 180 Key Exchange payload Next payload: Nonce (10) Payload length: 132 Key Exchange Data (128 bytes / 1024 bits) Nonce payload Next payload: NONE (0) Payload length: 20 Nonce Data 0000 00 24 b2 31 e1 3d 00 0c 29 48 f8 2f 08 00 45 00 .$.1.=..)H./..E. 0010 00 d0 00 00 40 00 40 11 fb 4e a5 e3 f9 7c a5 e3 ....@.@..N...|.. 0020 f9 8a 01 f4 01 f4 00 bc aa 37 a3 e7 ff d2 99 9e .........7...... 0030 6d 49 97 ec 59 f7 b4 da 8d 38 04 10 02 00 00 00 mI..Y....8...... 0040 00 00 00 00 00 b4 0a 00 00 84 4c d4 50 c8 d3 05 ..........L.P... 0050 b6 a2 21 b1 e7 78 0a 25 74 6f 94 d7 6e 2e 57 cd ..!..x.%to..n.W. 0060 6c d6 59 bf 0a 0c d4 b0 c9 12 4f 6a e2 f4 18 0c l.Y.......Oj.... 0070 47 e3 47 59 6e 0f 72 62 61 11 ce a8 1f 29 69 76 G.GYn.rba....)iv 0080 1e 7e ee a6 bf b2 c6 fa 62 f1 f4 86 64 65 67 6d .~......b...degm 0090 4d 7e cc e9 5f 5a df 6f f6 50 ee f2 cf 7e 3d 06 M~.._Z.o.P...~=. 00a0 60 b4 d9 e8 21 01 e9 80 53 03 1d c6 18 8c c0 80 `...!...S....... 00b0 40 49 89 2f 0a fb 8e f0 2e 0a 9f a2 52 e9 08 69 @I./........R..i 00c0 a8 ed 36 8a 3e 31 ae 1d 3a 6a 00 00 00 14 8f 03 ..6.>1..:j...... 00d0 61 1e 81 45 00 ee 33 44 dd 82 56 41 39 e1 a..E..3D..VA9. Frame 5 (222 bytes on wire, 222 bytes captured) Arrival Time: May 27, 2009 16:27:53.300073000 [Time delta from previous captured frame: 0.000016000 seconds] [Time delta from previous displayed frame: 0.000016000 seconds] [Time since reference or first frame: 0.278189000 seconds] Frame Number: 5 Frame Length: 222 bytes Capture Length: 222 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f), Dst: 00:24:b2:31:e1:3d (00:24:b2:31:e1:3d) Destination: 00:24:b2:31:e1:3d (00:24:b2:31:e1:3d) Address: 00:24:b2:31:e1:3d (00:24:b2:31:e1:3d) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) Address: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.124 (165.227.249.124), Dst: 165.227.249.138 (165.227.249.138) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 208 Identification: 0x0000 (0) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfb4e [correct] [Good: True] [Bad : False] Source: 165.227.249.124 (165.227.249.124) Destination: 165.227.249.138 (165.227.249.138) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 188 Checksum: 0xaa37 [correct] [Good Checksum: True] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: A3E7FFD2999E6D49 Responder cookie: 97EC59F7B4DA8D38 Next payload: Key Exchange (4) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags: 0x00 .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 180 Key Exchange payload Next payload: Nonce (10) Payload length: 132 Key Exchange Data (128 bytes / 1024 bits) Nonce payload Next payload: NONE (0) Payload length: 20 Nonce Data 0000 00 24 b2 31 e1 3d 00 0c 29 48 f8 2f 08 00 45 00 .$.1.=..)H./..E. 0010 00 d0 00 00 40 00 40 11 fb 4e a5 e3 f9 7c a5 e3 ....@.@..N...|.. 0020 f9 8a 01 f4 01 f4 00 bc aa 37 a3 e7 ff d2 99 9e .........7...... 0030 6d 49 97 ec 59 f7 b4 da 8d 38 04 10 02 00 00 00 mI..Y....8...... 0040 00 00 00 00 00 b4 0a 00 00 84 4c d4 50 c8 d3 05 ..........L.P... 0050 b6 a2 21 b1 e7 78 0a 25 74 6f 94 d7 6e 2e 57 cd ..!..x.%to..n.W. 0060 6c d6 59 bf 0a 0c d4 b0 c9 12 4f 6a e2 f4 18 0c l.Y.......Oj.... 0070 47 e3 47 59 6e 0f 72 62 61 11 ce a8 1f 29 69 76 G.GYn.rba....)iv 0080 1e 7e ee a6 bf b2 c6 fa 62 f1 f4 86 64 65 67 6d .~......b...degm 0090 4d 7e cc e9 5f 5a df 6f f6 50 ee f2 cf 7e 3d 06 M~.._Z.o.P...~=. 00a0 60 b4 d9 e8 21 01 e9 80 53 03 1d c6 18 8c c0 80 `...!...S....... 00b0 40 49 89 2f 0a fb 8e f0 2e 0a 9f a2 52 e9 08 69 @I./........R..i 00c0 a8 ed 36 8a 3e 31 ae 1d 3a 6a 00 00 00 14 8f 03 ..6.>1..:j...... 00d0 61 1e 81 45 00 ee 33 44 dd 82 56 41 39 e1 a..E..3D..VA9. Frame 6 (242 bytes on wire, 242 bytes captured) Arrival Time: May 27, 2009 16:27:53.648367000 [Time delta from previous captured frame: 0.348294000 seconds] [Time delta from previous displayed frame: 0.348294000 seconds] [Time since reference or first frame: 0.626483000 seconds] Frame Number: 6 Frame Length: 242 bytes Capture Length: 242 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:24:b2:31:e1:3d (00:24:b2:31:e1:3d), Dst: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) Destination: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) Address: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:24:b2:31:e1:3d (00:24:b2:31:e1:3d) Address: 00:24:b2:31:e1:3d (00:24:b2:31:e1:3d) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.138 (165.227.249.138), Dst: 165.227.249.124 (165.227.249.124) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 228 Identification: 0x0000 (0) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfb3a [correct] [Good: True] [Bad : False] Source: 165.227.249.138 (165.227.249.138) Destination: 165.227.249.124 (165.227.249.124) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 208 Checksum: 0x26bd [correct] [Good Checksum: True] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: A3E7FFD2999E6D49 Responder cookie: 97EC59F7B4DA8D38 Next payload: Key Exchange (4) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags: 0x00 .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 200 Key Exchange payload Next payload: Nonce (10) Payload length: 132 Key Exchange Data (128 bytes / 1024 bits) Nonce payload Next payload: Vendor ID (13) Payload length: 20 Nonce Data Vendor ID: 7003CBC1097DBE9C2600BA6983BC8B35 Next payload: NONE (0) Payload length: 20 Vendor ID: 7003CBC1097DBE9C2600BA6983BC8B35 0000 00 0c 29 48 f8 2f 00 24 b2 31 e1 3d 08 00 45 00 ..)H./.$.1.=..E. 0010 00 e4 00 00 40 00 40 11 fb 3a a5 e3 f9 8a a5 e3 ....@.@..:...... 0020 f9 7c 01 f4 01 f4 00 d0 26 bd a3 e7 ff d2 99 9e .|......&....... 0030 6d 49 97 ec 59 f7 b4 da 8d 38 04 10 02 00 00 00 mI..Y....8...... 0040 00 00 00 00 00 c8 0a 00 00 84 1c f9 b1 1c c3 28 ...............( 0050 9d a5 42 70 be fc 49 21 ab fb 28 42 a6 3f ae 82 ..Bp..I!..(B.?.. 0060 90 b1 ca 98 b3 63 e4 d5 38 a9 b2 bd 05 5e bf 95 .....c..8....^.. 0070 cb 65 a4 e1 8b 82 88 c9 e1 3c 65 09 f7 91 27 ac .e.......|....@r.... 00b0 5d 39 36 a0 11 f2 f5 cf 23 26 a9 bc 5b 9d 23 c3 ]96.....#&..[.#. 00c0 e9 94 37 2c ea cd 9d 36 38 e7 0d 00 00 14 d4 77 ..7,...68......w 00d0 be 91 c7 e1 4d ee 70 e3 f5 26 aa 8a dc ed 00 00 ....M.p..&...... 00e0 00 14 70 03 cb c1 09 7d be 9c 26 00 ba 69 83 bc ..p....}..&..i.. 00f0 8b 35 .5 Frame 7 (134 bytes on wire, 134 bytes captured) Arrival Time: May 27, 2009 16:27:53.653316000 [Time delta from previous captured frame: 0.004949000 seconds] [Time delta from previous displayed frame: 0.004949000 seconds] [Time since reference or first frame: 0.631432000 seconds] Frame Number: 7 Frame Length: 134 bytes Capture Length: 134 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f), Dst: 00:24:b2:31:e1:3d (00:24:b2:31:e1:3d) Destination: 00:24:b2:31:e1:3d (00:24:b2:31:e1:3d) Address: 00:24:b2:31:e1:3d (00:24:b2:31:e1:3d) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) Address: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.124 (165.227.249.124), Dst: 165.227.249.138 (165.227.249.138) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 120 Identification: 0x0000 (0) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfba6 [correct] [Good: True] [Bad : False] Source: 165.227.249.124 (165.227.249.124) Destination: 165.227.249.138 (165.227.249.138) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 100 Checksum: 0xfab8 [correct] [Good Checksum: True] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: A3E7FFD2999E6D49 Responder cookie: 97EC59F7B4DA8D38 Next payload: Identification (5) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags: 0x01 .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 92 Encrypted payload (64 bytes) 0000 00 24 b2 31 e1 3d 00 0c 29 48 f8 2f 08 00 45 00 .$.1.=..)H./..E. 0010 00 78 00 00 40 00 40 11 fb a6 a5 e3 f9 7c a5 e3 .x..@.@......|.. 0020 f9 8a 01 f4 01 f4 00 64 fa b8 a3 e7 ff d2 99 9e .......d........ 0030 6d 49 97 ec 59 f7 b4 da 8d 38 05 10 02 01 00 00 mI..Y....8...... 0040 00 00 00 00 00 5c 8b 4a cf f0 d1 0c 3a b0 3e 14 .....\.J....:.>. 0050 34 ef 61 56 cd ba 13 eb f1 6c cc 69 23 fe ab ef 4.aV.....l.i#... 0060 39 2f 88 f1 9f d9 ba a6 c8 e1 5d a9 fb ed 61 a7 9/........]...a. 0070 d2 35 08 1a ba 5a 27 47 10 35 be e7 a1 29 db c0 .5...Z'G.5...).. 0080 83 53 22 23 e2 c1 .S"#.. Frame 8 (134 bytes on wire, 134 bytes captured) Arrival Time: May 27, 2009 16:27:53.653329000 [Time delta from previous captured frame: 0.000013000 seconds] [Time delta from previous displayed frame: 0.000013000 seconds] [Time since reference or first frame: 0.631445000 seconds] Frame Number: 8 Frame Length: 134 bytes Capture Length: 134 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f), Dst: 00:24:b2:31:e1:3d (00:24:b2:31:e1:3d) Destination: 00:24:b2:31:e1:3d (00:24:b2:31:e1:3d) Address: 00:24:b2:31:e1:3d (00:24:b2:31:e1:3d) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) Address: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.124 (165.227.249.124), Dst: 165.227.249.138 (165.227.249.138) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 120 Identification: 0x0000 (0) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfba6 [correct] [Good: True] [Bad : False] Source: 165.227.249.124 (165.227.249.124) Destination: 165.227.249.138 (165.227.249.138) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 100 Checksum: 0xfab8 [correct] [Good Checksum: True] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: A3E7FFD2999E6D49 Responder cookie: 97EC59F7B4DA8D38 Next payload: Identification (5) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags: 0x01 .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 92 Encrypted payload (64 bytes) 0000 00 24 b2 31 e1 3d 00 0c 29 48 f8 2f 08 00 45 00 .$.1.=..)H./..E. 0010 00 78 00 00 40 00 40 11 fb a6 a5 e3 f9 7c a5 e3 .x..@.@......|.. 0020 f9 8a 01 f4 01 f4 00 64 fa b8 a3 e7 ff d2 99 9e .......d........ 0030 6d 49 97 ec 59 f7 b4 da 8d 38 05 10 02 01 00 00 mI..Y....8...... 0040 00 00 00 00 00 5c 8b 4a cf f0 d1 0c 3a b0 3e 14 .....\.J....:.>. 0050 34 ef 61 56 cd ba 13 eb f1 6c cc 69 23 fe ab ef 4.aV.....l.i#... 0060 39 2f 88 f1 9f d9 ba a6 c8 e1 5d a9 fb ed 61 a7 9/........]...a. 0070 d2 35 08 1a ba 5a 27 47 10 35 be e7 a1 29 db c0 .5...Z'G.5...).. 0080 83 53 22 23 e2 c1 .S"#.. Frame 9 (134 bytes on wire, 134 bytes captured) Arrival Time: May 27, 2009 16:27:54.154081000 [Time delta from previous captured frame: 0.500752000 seconds] [Time delta from previous displayed frame: 0.500752000 seconds] [Time since reference or first frame: 1.132197000 seconds] Frame Number: 9 Frame Length: 134 bytes Capture Length: 134 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f), Dst: 00:24:b2:31:e1:3d (00:24:b2:31:e1:3d) Destination: 00:24:b2:31:e1:3d (00:24:b2:31:e1:3d) Address: 00:24:b2:31:e1:3d (00:24:b2:31:e1:3d) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) Address: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.124 (165.227.249.124), Dst: 165.227.249.138 (165.227.249.138) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 120 Identification: 0x0000 (0) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfba6 [correct] [Good: True] [Bad : False] Source: 165.227.249.124 (165.227.249.124) Destination: 165.227.249.138 (165.227.249.138) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 100 Checksum: 0xfab8 [correct] [Good Checksum: True] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: A3E7FFD2999E6D49 Responder cookie: 97EC59F7B4DA8D38 Next payload: Identification (5) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags: 0x01 .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 92 Encrypted payload (64 bytes) 0000 00 24 b2 31 e1 3d 00 0c 29 48 f8 2f 08 00 45 00 .$.1.=..)H./..E. 0010 00 78 00 00 40 00 40 11 fb a6 a5 e3 f9 7c a5 e3 .x..@.@......|.. 0020 f9 8a 01 f4 01 f4 00 64 fa b8 a3 e7 ff d2 99 9e .......d........ 0030 6d 49 97 ec 59 f7 b4 da 8d 38 05 10 02 01 00 00 mI..Y....8...... 0040 00 00 00 00 00 5c 8b 4a cf f0 d1 0c 3a b0 3e 14 .....\.J....:.>. 0050 34 ef 61 56 cd ba 13 eb f1 6c cc 69 23 fe ab ef 4.aV.....l.i#... 0060 39 2f 88 f1 9f d9 ba a6 c8 e1 5d a9 fb ed 61 a7 9/........]...a. 0070 d2 35 08 1a ba 5a 27 47 10 35 be e7 a1 29 db c0 .5...Z'G.5...).. 0080 83 53 22 23 e2 c1 .S"#.. Frame 10 (134 bytes on wire, 134 bytes captured) Arrival Time: May 27, 2009 16:27:54.154094000 [Time delta from previous captured frame: 0.000013000 seconds] [Time delta from previous displayed frame: 0.000013000 seconds] [Time since reference or first frame: 1.132210000 seconds] Frame Number: 10 Frame Length: 134 bytes Capture Length: 134 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f), Dst: 00:24:b2:31:e1:3d (00:24:b2:31:e1:3d) Destination: 00:24:b2:31:e1:3d (00:24:b2:31:e1:3d) Address: 00:24:b2:31:e1:3d (00:24:b2:31:e1:3d) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) Address: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.124 (165.227.249.124), Dst: 165.227.249.138 (165.227.249.138) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 120 Identification: 0x0000 (0) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfba6 [correct] [Good: True] [Bad : False] Source: 165.227.249.124 (165.227.249.124) Destination: 165.227.249.138 (165.227.249.138) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 100 Checksum: 0xfab8 [correct] [Good Checksum: True] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: A3E7FFD2999E6D49 Responder cookie: 97EC59F7B4DA8D38 Next payload: Identification (5) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags: 0x01 .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 92 Encrypted payload (64 bytes) 0000 00 24 b2 31 e1 3d 00 0c 29 48 f8 2f 08 00 45 00 .$.1.=..)H./..E. 0010 00 78 00 00 40 00 40 11 fb a6 a5 e3 f9 7c a5 e3 .x..@.@......|.. 0020 f9 8a 01 f4 01 f4 00 64 fa b8 a3 e7 ff d2 99 9e .......d........ 0030 6d 49 97 ec 59 f7 b4 da 8d 38 05 10 02 01 00 00 mI..Y....8...... 0040 00 00 00 00 00 5c 8b 4a cf f0 d1 0c 3a b0 3e 14 .....\.J....:.>. 0050 34 ef 61 56 cd ba 13 eb f1 6c cc 69 23 fe ab ef 4.aV.....l.i#... 0060 39 2f 88 f1 9f d9 ba a6 c8 e1 5d a9 fb ed 61 a7 9/........]...a. 0070 d2 35 08 1a ba 5a 27 47 10 35 be e7 a1 29 db c0 .5...Z'G.5...).. 0080 83 53 22 23 e2 c1 .S"#.. Frame 11 (118 bytes on wire, 118 bytes captured) Arrival Time: May 27, 2009 16:27:54.238138000 [Time delta from previous captured frame: 0.084044000 seconds] [Time delta from previous displayed frame: 0.084044000 seconds] [Time since reference or first frame: 1.216254000 seconds] Frame Number: 11 Frame Length: 118 bytes Capture Length: 118 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:24:b2:31:e1:3d (00:24:b2:31:e1:3d), Dst: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) Destination: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) Address: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:24:b2:31:e1:3d (00:24:b2:31:e1:3d) Address: 00:24:b2:31:e1:3d (00:24:b2:31:e1:3d) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.138 (165.227.249.138), Dst: 165.227.249.124 (165.227.249.124) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 104 Identification: 0x0000 (0) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfbb6 [correct] [Good: True] [Bad : False] Source: 165.227.249.138 (165.227.249.138) Destination: 165.227.249.124 (165.227.249.124) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 84 Checksum: 0xb6ae [correct] [Good Checksum: True] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: A3E7FFD2999E6D49 Responder cookie: 97EC59F7B4DA8D38 Next payload: Identification (5) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags: 0x01 .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 76 Encrypted payload (48 bytes) 0000 00 0c 29 48 f8 2f 00 24 b2 31 e1 3d 08 00 45 00 ..)H./.$.1.=..E. 0010 00 68 00 00 40 00 40 11 fb b6 a5 e3 f9 8a a5 e3 .h..@.@......... 0020 f9 7c 01 f4 01 f4 00 54 b6 ae a3 e7 ff d2 99 9e .|.....T........ 0030 6d 49 97 ec 59 f7 b4 da 8d 38 05 10 02 01 00 00 mI..Y....8...... 0040 00 00 00 00 00 4c f2 db 60 67 5a f4 c5 02 1d b8 .....L..`gZ..... 0050 24 75 6e 1d 0c b8 43 57 ca c4 83 38 69 88 45 30 $un...CW...8i.E0 0060 40 87 eb 70 e2 83 5d 2d 7d 77 02 c8 04 63 63 84 @..p..]-}w...cc. 0070 81 89 1c b8 bd 8d ...... Frame 12 (406 bytes on wire, 406 bytes captured) Arrival Time: May 27, 2009 16:27:54.248675000 [Time delta from previous captured frame: 0.010537000 seconds] [Time delta from previous displayed frame: 0.010537000 seconds] [Time since reference or first frame: 1.226791000 seconds] Frame Number: 12 Frame Length: 406 bytes Capture Length: 406 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f), Dst: 00:24:b2:31:e1:3d (00:24:b2:31:e1:3d) Destination: 00:24:b2:31:e1:3d (00:24:b2:31:e1:3d) Address: 00:24:b2:31:e1:3d (00:24:b2:31:e1:3d) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) Address: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.124 (165.227.249.124), Dst: 165.227.249.138 (165.227.249.138) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 392 Identification: 0x0000 (0) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfa96 [correct] [Good: True] [Bad : False] Source: 165.227.249.124 (165.227.249.124) Destination: 165.227.249.138 (165.227.249.138) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 372 Checksum: 0xe349 [correct] [Good Checksum: True] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: A3E7FFD2999E6D49 Responder cookie: 97EC59F7B4DA8D38 Next payload: Hash (8) Version: 1.0 Exchange type: Quick Mode (32) Flags: 0x01 .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x17485f0b Length: 364 Encrypted payload (336 bytes) 0000 00 24 b2 31 e1 3d 00 0c 29 48 f8 2f 08 00 45 00 .$.1.=..)H./..E. 0010 01 88 00 00 40 00 40 11 fa 96 a5 e3 f9 7c a5 e3 ....@.@......|.. 0020 f9 8a 01 f4 01 f4 01 74 e3 49 a3 e7 ff d2 99 9e .......t.I...... 0030 6d 49 97 ec 59 f7 b4 da 8d 38 08 10 20 01 17 48 mI..Y....8.. ..H 0040 5f 0b 00 00 01 6c 34 70 ec de cf 45 b1 7f 95 5c _....l4p...E...\ 0050 f0 8e 7f 35 19 31 26 a3 b5 b2 60 ee 5b 67 21 cd ...5.1&...`.[g!. 0060 4c 91 d5 13 84 79 a1 62 36 79 cf c0 44 11 1f c5 L....y.b6y..D... 0070 26 9f 92 11 40 1d f8 23 64 b1 b2 c4 89 b6 0e 66 &...@..#d......f 0080 5f 9f c3 10 72 42 fb 4c 56 23 e8 c8 2e 2e 24 d6 _...rB.LV#....$. 0090 f6 04 df 5e 44 52 d9 5e df 93 0e 3f 36 02 97 42 ...^DR.^...?6..B 00a0 e0 8c 2d 29 f7 f2 fd 49 e8 20 a8 e8 0c 70 6c e7 ..-)...I. ...pl. 00b0 e5 36 df 60 b0 90 a7 3c c8 a7 44 70 49 fc d7 ab .6.`...<..DpI... 00c0 ca 5f 27 26 1e da a5 7a 34 e0 86 10 4d 06 74 dc ._'&...z4...M.t. 00d0 87 5e 69 c5 8c 03 49 e4 17 e5 e8 89 c4 4b 4c ec .^i...I......KL. 00e0 58 e2 55 0b 58 20 22 e3 0e 7e b4 e0 95 0d 86 d0 X.U.X "..~...... 00f0 6a c1 78 24 82 16 e6 f0 2f bd c1 94 51 1e 91 77 j.x$..../...Q..w 0100 39 7a c4 1f 22 07 18 22 8f 6a 6b 81 be ca 3a d1 9z.."..".jk...:. 0110 f9 23 16 38 4d f2 69 ee 43 94 a2 d4 ca 79 f6 11 .#.8M.i.C....y.. 0120 82 4a c3 18 da b5 d6 61 9e cc f2 a2 12 3e 7d 6a .J.....a.....>}j 0130 f4 d9 3d 1d e3 16 38 df ad 68 4f e2 01 4f e0 6e ..=...8..hO..O.n 0140 83 18 22 c9 f5 f0 2e c5 29 db b2 86 bf 49 84 c3 ..".....)....I.. 0150 0b 91 9e d3 91 eb 0e 74 1d 4c 6a ca a1 dc 55 6e .......t.Lj...Un 0160 32 e0 14 dc 2d 1a 5f c3 db 04 6a a4 05 9d 2f e6 2...-._...j.../. 0170 97 fe 9f e3 35 24 2c 9c a8 5a b2 14 0e 35 db 63 ....5$,..Z...5.c 0180 15 f5 3f 7e f1 b9 9e ce d8 1f ca 2c f1 f7 4a c7 ..?~.......,..J. 0190 ff a8 cf a5 d9 70 .....p Frame 13 (406 bytes on wire, 406 bytes captured) Arrival Time: May 27, 2009 16:27:54.248687000 [Time delta from previous captured frame: 0.000012000 seconds] [Time delta from previous displayed frame: 0.000012000 seconds] [Time since reference or first frame: 1.226803000 seconds] Frame Number: 13 Frame Length: 406 bytes Capture Length: 406 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f), Dst: 00:24:b2:31:e1:3d (00:24:b2:31:e1:3d) Destination: 00:24:b2:31:e1:3d (00:24:b2:31:e1:3d) Address: 00:24:b2:31:e1:3d (00:24:b2:31:e1:3d) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) Address: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.124 (165.227.249.124), Dst: 165.227.249.138 (165.227.249.138) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 392 Identification: 0x0000 (0) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfa96 [correct] [Good: True] [Bad : False] Source: 165.227.249.124 (165.227.249.124) Destination: 165.227.249.138 (165.227.249.138) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 372 Checksum: 0xe349 [correct] [Good Checksum: True] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: A3E7FFD2999E6D49 Responder cookie: 97EC59F7B4DA8D38 Next payload: Hash (8) Version: 1.0 Exchange type: Quick Mode (32) Flags: 0x01 .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x17485f0b Length: 364 Encrypted payload (336 bytes) 0000 00 24 b2 31 e1 3d 00 0c 29 48 f8 2f 08 00 45 00 .$.1.=..)H./..E. 0010 01 88 00 00 40 00 40 11 fa 96 a5 e3 f9 7c a5 e3 ....@.@......|.. 0020 f9 8a 01 f4 01 f4 01 74 e3 49 a3 e7 ff d2 99 9e .......t.I...... 0030 6d 49 97 ec 59 f7 b4 da 8d 38 08 10 20 01 17 48 mI..Y....8.. ..H 0040 5f 0b 00 00 01 6c 34 70 ec de cf 45 b1 7f 95 5c _....l4p...E...\ 0050 f0 8e 7f 35 19 31 26 a3 b5 b2 60 ee 5b 67 21 cd ...5.1&...`.[g!. 0060 4c 91 d5 13 84 79 a1 62 36 79 cf c0 44 11 1f c5 L....y.b6y..D... 0070 26 9f 92 11 40 1d f8 23 64 b1 b2 c4 89 b6 0e 66 &...@..#d......f 0080 5f 9f c3 10 72 42 fb 4c 56 23 e8 c8 2e 2e 24 d6 _...rB.LV#....$. 0090 f6 04 df 5e 44 52 d9 5e df 93 0e 3f 36 02 97 42 ...^DR.^...?6..B 00a0 e0 8c 2d 29 f7 f2 fd 49 e8 20 a8 e8 0c 70 6c e7 ..-)...I. ...pl. 00b0 e5 36 df 60 b0 90 a7 3c c8 a7 44 70 49 fc d7 ab .6.`...<..DpI... 00c0 ca 5f 27 26 1e da a5 7a 34 e0 86 10 4d 06 74 dc ._'&...z4...M.t. 00d0 87 5e 69 c5 8c 03 49 e4 17 e5 e8 89 c4 4b 4c ec .^i...I......KL. 00e0 58 e2 55 0b 58 20 22 e3 0e 7e b4 e0 95 0d 86 d0 X.U.X "..~...... 00f0 6a c1 78 24 82 16 e6 f0 2f bd c1 94 51 1e 91 77 j.x$..../...Q..w 0100 39 7a c4 1f 22 07 18 22 8f 6a 6b 81 be ca 3a d1 9z.."..".jk...:. 0110 f9 23 16 38 4d f2 69 ee 43 94 a2 d4 ca 79 f6 11 .#.8M.i.C....y.. 0120 82 4a c3 18 da b5 d6 61 9e cc f2 a2 12 3e 7d 6a .J.....a.....>}j 0130 f4 d9 3d 1d e3 16 38 df ad 68 4f e2 01 4f e0 6e ..=...8..hO..O.n 0140 83 18 22 c9 f5 f0 2e c5 29 db b2 86 bf 49 84 c3 ..".....)....I.. 0150 0b 91 9e d3 91 eb 0e 74 1d 4c 6a ca a1 dc 55 6e .......t.Lj...Un 0160 32 e0 14 dc 2d 1a 5f c3 db 04 6a a4 05 9d 2f e6 2...-._...j.../. 0170 97 fe 9f e3 35 24 2c 9c a8 5a b2 14 0e 35 db 63 ....5$,..Z...5.c 0180 15 f5 3f 7e f1 b9 9e ce d8 1f ca 2c f1 f7 4a c7 ..?~.......,..J. 0190 ff a8 cf a5 d9 70 .....p Frame 14 (134 bytes on wire, 134 bytes captured) Arrival Time: May 27, 2009 16:27:54.317517000 [Time delta from previous captured frame: 0.068830000 seconds] [Time delta from previous displayed frame: 0.068830000 seconds] [Time since reference or first frame: 1.295633000 seconds] Frame Number: 14 Frame Length: 134 bytes Capture Length: 134 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:24:b2:31:e1:3d (00:24:b2:31:e1:3d), Dst: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) Destination: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) Address: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:24:b2:31:e1:3d (00:24:b2:31:e1:3d) Address: 00:24:b2:31:e1:3d (00:24:b2:31:e1:3d) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.138 (165.227.249.138), Dst: 165.227.249.124 (165.227.249.124) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 120 Identification: 0x0000 (0) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfba6 [correct] [Good: True] [Bad : False] Source: 165.227.249.138 (165.227.249.138) Destination: 165.227.249.124 (165.227.249.124) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 100 Checksum: 0x544d [correct] [Good Checksum: True] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: A3E7FFD2999E6D49 Responder cookie: 97EC59F7B4DA8D38 Next payload: Hash (8) Version: 1.0 Exchange type: Informational (5) Flags: 0x01 .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x909a80ca Length: 92 Encrypted payload (64 bytes) 0000 00 0c 29 48 f8 2f 00 24 b2 31 e1 3d 08 00 45 00 ..)H./.$.1.=..E. 0010 00 78 00 00 40 00 40 11 fb a6 a5 e3 f9 8a a5 e3 .x..@.@......... 0020 f9 7c 01 f4 01 f4 00 64 54 4d a3 e7 ff d2 99 9e .|.....dTM...... 0030 6d 49 97 ec 59 f7 b4 da 8d 38 08 10 05 01 90 9a mI..Y....8...... 0040 80 ca 00 00 00 5c 13 46 eb 8d ab 18 66 7f 16 af .....\.F....f... 0050 38 4f 44 39 11 c3 e9 95 af 09 e5 66 60 5a d6 04 8OD9.......f`Z.. 0060 d9 60 64 59 5a ad 17 e9 42 31 30 72 e6 bd ad 25 .`dYZ...B10r...% 0070 a8 b0 1f b3 c3 59 71 3b 75 51 5c db e4 5c 51 f4 .....Yq;uQ\..\Q. 0080 a3 a6 6c 56 34 9e ..lV4. Frame 15 (118 bytes on wire, 118 bytes captured) Arrival Time: May 27, 2009 16:27:54.348527000 [Time delta from previous captured frame: 0.031010000 seconds] [Time delta from previous displayed frame: 0.031010000 seconds] [Time since reference or first frame: 1.326643000 seconds] Frame Number: 15 Frame Length: 118 bytes Capture Length: 118 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:24:b2:31:e1:3d (00:24:b2:31:e1:3d), Dst: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) Destination: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) Address: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:24:b2:31:e1:3d (00:24:b2:31:e1:3d) Address: 00:24:b2:31:e1:3d (00:24:b2:31:e1:3d) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.138 (165.227.249.138), Dst: 165.227.249.124 (165.227.249.124) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 104 Identification: 0x0000 (0) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfbb6 [correct] [Good: True] [Bad : False] Source: 165.227.249.138 (165.227.249.138) Destination: 165.227.249.124 (165.227.249.124) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 84 Checksum: 0xb6ae [correct] [Good Checksum: True] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: A3E7FFD2999E6D49 Responder cookie: 97EC59F7B4DA8D38 Next payload: Identification (5) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags: 0x01 .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 76 Encrypted payload (48 bytes) 0000 00 0c 29 48 f8 2f 00 24 b2 31 e1 3d 08 00 45 00 ..)H./.$.1.=..E. 0010 00 68 00 00 40 00 40 11 fb b6 a5 e3 f9 8a a5 e3 .h..@.@......... 0020 f9 7c 01 f4 01 f4 00 54 b6 ae a3 e7 ff d2 99 9e .|.....T........ 0030 6d 49 97 ec 59 f7 b4 da 8d 38 05 10 02 01 00 00 mI..Y....8...... 0040 00 00 00 00 00 4c f2 db 60 67 5a f4 c5 02 1d b8 .....L..`gZ..... 0050 24 75 6e 1d 0c b8 43 57 ca c4 83 38 69 88 45 30 $un...CW...8i.E0 0060 40 87 eb 70 e2 83 5d 2d 7d 77 02 c8 04 63 63 84 @..p..]-}w...cc. 0070 81 89 1c b8 bd 8d ...... Frame 16 (406 bytes on wire, 406 bytes captured) Arrival Time: May 27, 2009 16:27:54.753062000 [Time delta from previous captured frame: 0.404535000 seconds] [Time delta from previous displayed frame: 0.404535000 seconds] [Time since reference or first frame: 1.731178000 seconds] Frame Number: 16 Frame Length: 406 bytes Capture Length: 406 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f), Dst: 00:24:b2:31:e1:3d (00:24:b2:31:e1:3d) Destination: 00:24:b2:31:e1:3d (00:24:b2:31:e1:3d) Address: 00:24:b2:31:e1:3d (00:24:b2:31:e1:3d) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) Address: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.124 (165.227.249.124), Dst: 165.227.249.138 (165.227.249.138) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 392 Identification: 0x0000 (0) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfa96 [correct] [Good: True] [Bad : False] Source: 165.227.249.124 (165.227.249.124) Destination: 165.227.249.138 (165.227.249.138) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 372 Checksum: 0xe349 [correct] [Good Checksum: True] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: A3E7FFD2999E6D49 Responder cookie: 97EC59F7B4DA8D38 Next payload: Hash (8) Version: 1.0 Exchange type: Quick Mode (32) Flags: 0x01 .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x17485f0b Length: 364 Encrypted payload (336 bytes) 0000 00 24 b2 31 e1 3d 00 0c 29 48 f8 2f 08 00 45 00 .$.1.=..)H./..E. 0010 01 88 00 00 40 00 40 11 fa 96 a5 e3 f9 7c a5 e3 ....@.@......|.. 0020 f9 8a 01 f4 01 f4 01 74 e3 49 a3 e7 ff d2 99 9e .......t.I...... 0030 6d 49 97 ec 59 f7 b4 da 8d 38 08 10 20 01 17 48 mI..Y....8.. ..H 0040 5f 0b 00 00 01 6c 34 70 ec de cf 45 b1 7f 95 5c _....l4p...E...\ 0050 f0 8e 7f 35 19 31 26 a3 b5 b2 60 ee 5b 67 21 cd ...5.1&...`.[g!. 0060 4c 91 d5 13 84 79 a1 62 36 79 cf c0 44 11 1f c5 L....y.b6y..D... 0070 26 9f 92 11 40 1d f8 23 64 b1 b2 c4 89 b6 0e 66 &...@..#d......f 0080 5f 9f c3 10 72 42 fb 4c 56 23 e8 c8 2e 2e 24 d6 _...rB.LV#....$. 0090 f6 04 df 5e 44 52 d9 5e df 93 0e 3f 36 02 97 42 ...^DR.^...?6..B 00a0 e0 8c 2d 29 f7 f2 fd 49 e8 20 a8 e8 0c 70 6c e7 ..-)...I. ...pl. 00b0 e5 36 df 60 b0 90 a7 3c c8 a7 44 70 49 fc d7 ab .6.`...<..DpI... 00c0 ca 5f 27 26 1e da a5 7a 34 e0 86 10 4d 06 74 dc ._'&...z4...M.t. 00d0 87 5e 69 c5 8c 03 49 e4 17 e5 e8 89 c4 4b 4c ec .^i...I......KL. 00e0 58 e2 55 0b 58 20 22 e3 0e 7e b4 e0 95 0d 86 d0 X.U.X "..~...... 00f0 6a c1 78 24 82 16 e6 f0 2f bd c1 94 51 1e 91 77 j.x$..../...Q..w 0100 39 7a c4 1f 22 07 18 22 8f 6a 6b 81 be ca 3a d1 9z.."..".jk...:. 0110 f9 23 16 38 4d f2 69 ee 43 94 a2 d4 ca 79 f6 11 .#.8M.i.C....y.. 0120 82 4a c3 18 da b5 d6 61 9e cc f2 a2 12 3e 7d 6a .J.....a.....>}j 0130 f4 d9 3d 1d e3 16 38 df ad 68 4f e2 01 4f e0 6e ..=...8..hO..O.n 0140 83 18 22 c9 f5 f0 2e c5 29 db b2 86 bf 49 84 c3 ..".....)....I.. 0150 0b 91 9e d3 91 eb 0e 74 1d 4c 6a ca a1 dc 55 6e .......t.Lj...Un 0160 32 e0 14 dc 2d 1a 5f c3 db 04 6a a4 05 9d 2f e6 2...-._...j.../. 0170 97 fe 9f e3 35 24 2c 9c a8 5a b2 14 0e 35 db 63 ....5$,..Z...5.c 0180 15 f5 3f 7e f1 b9 9e ce d8 1f ca 2c f1 f7 4a c7 ..?~.......,..J. 0190 ff a8 cf a5 d9 70 .....p Frame 17 (406 bytes on wire, 406 bytes captured) Arrival Time: May 27, 2009 16:27:54.753074000 [Time delta from previous captured frame: 0.000012000 seconds] [Time delta from previous displayed frame: 0.000012000 seconds] [Time since reference or first frame: 1.731190000 seconds] Frame Number: 17 Frame Length: 406 bytes Capture Length: 406 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f), Dst: 00:24:b2:31:e1:3d (00:24:b2:31:e1:3d) Destination: 00:24:b2:31:e1:3d (00:24:b2:31:e1:3d) Address: 00:24:b2:31:e1:3d (00:24:b2:31:e1:3d) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) Address: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.124 (165.227.249.124), Dst: 165.227.249.138 (165.227.249.138) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 392 Identification: 0x0000 (0) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfa96 [correct] [Good: True] [Bad : False] Source: 165.227.249.124 (165.227.249.124) Destination: 165.227.249.138 (165.227.249.138) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 372 Checksum: 0xe349 [correct] [Good Checksum: True] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: A3E7FFD2999E6D49 Responder cookie: 97EC59F7B4DA8D38 Next payload: Hash (8) Version: 1.0 Exchange type: Quick Mode (32) Flags: 0x01 .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x17485f0b Length: 364 Encrypted payload (336 bytes) 0000 00 24 b2 31 e1 3d 00 0c 29 48 f8 2f 08 00 45 00 .$.1.=..)H./..E. 0010 01 88 00 00 40 00 40 11 fa 96 a5 e3 f9 7c a5 e3 ....@.@......|.. 0020 f9 8a 01 f4 01 f4 01 74 e3 49 a3 e7 ff d2 99 9e .......t.I...... 0030 6d 49 97 ec 59 f7 b4 da 8d 38 08 10 20 01 17 48 mI..Y....8.. ..H 0040 5f 0b 00 00 01 6c 34 70 ec de cf 45 b1 7f 95 5c _....l4p...E...\ 0050 f0 8e 7f 35 19 31 26 a3 b5 b2 60 ee 5b 67 21 cd ...5.1&...`.[g!. 0060 4c 91 d5 13 84 79 a1 62 36 79 cf c0 44 11 1f c5 L....y.b6y..D... 0070 26 9f 92 11 40 1d f8 23 64 b1 b2 c4 89 b6 0e 66 &...@..#d......f 0080 5f 9f c3 10 72 42 fb 4c 56 23 e8 c8 2e 2e 24 d6 _...rB.LV#....$. 0090 f6 04 df 5e 44 52 d9 5e df 93 0e 3f 36 02 97 42 ...^DR.^...?6..B 00a0 e0 8c 2d 29 f7 f2 fd 49 e8 20 a8 e8 0c 70 6c e7 ..-)...I. ...pl. 00b0 e5 36 df 60 b0 90 a7 3c c8 a7 44 70 49 fc d7 ab .6.`...<..DpI... 00c0 ca 5f 27 26 1e da a5 7a 34 e0 86 10 4d 06 74 dc ._'&...z4...M.t. 00d0 87 5e 69 c5 8c 03 49 e4 17 e5 e8 89 c4 4b 4c ec .^i...I......KL. 00e0 58 e2 55 0b 58 20 22 e3 0e 7e b4 e0 95 0d 86 d0 X.U.X "..~...... 00f0 6a c1 78 24 82 16 e6 f0 2f bd c1 94 51 1e 91 77 j.x$..../...Q..w 0100 39 7a c4 1f 22 07 18 22 8f 6a 6b 81 be ca 3a d1 9z.."..".jk...:. 0110 f9 23 16 38 4d f2 69 ee 43 94 a2 d4 ca 79 f6 11 .#.8M.i.C....y.. 0120 82 4a c3 18 da b5 d6 61 9e cc f2 a2 12 3e 7d 6a .J.....a.....>}j 0130 f4 d9 3d 1d e3 16 38 df ad 68 4f e2 01 4f e0 6e ..=...8..hO..O.n 0140 83 18 22 c9 f5 f0 2e c5 29 db b2 86 bf 49 84 c3 ..".....)....I.. 0150 0b 91 9e d3 91 eb 0e 74 1d 4c 6a ca a1 dc 55 6e .......t.Lj...Un 0160 32 e0 14 dc 2d 1a 5f c3 db 04 6a a4 05 9d 2f e6 2...-._...j.../. 0170 97 fe 9f e3 35 24 2c 9c a8 5a b2 14 0e 35 db 63 ....5$,..Z...5.c 0180 15 f5 3f 7e f1 b9 9e ce d8 1f ca 2c f1 f7 4a c7 ..?~.......,..J. 0190 ff a8 cf a5 d9 70 .....p Frame 18 (342 bytes on wire, 342 bytes captured) Arrival Time: May 27, 2009 16:27:55.357624000 [Time delta from previous captured frame: 0.604550000 seconds] [Time delta from previous displayed frame: 0.604550000 seconds] [Time since reference or first frame: 2.335740000 seconds] Frame Number: 18 Frame Length: 342 bytes Capture Length: 342 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:24:b2:31:e1:3d (00:24:b2:31:e1:3d), Dst: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) Destination: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) Address: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:24:b2:31:e1:3d (00:24:b2:31:e1:3d) Address: 00:24:b2:31:e1:3d (00:24:b2:31:e1:3d) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.138 (165.227.249.138), Dst: 165.227.249.124 (165.227.249.124) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 328 Identification: 0x0000 (0) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfad6 [correct] [Good: True] [Bad : False] Source: 165.227.249.138 (165.227.249.138) Destination: 165.227.249.124 (165.227.249.124) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 308 Checksum: 0xc03e [correct] [Good Checksum: True] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: A3E7FFD2999E6D49 Responder cookie: 97EC59F7B4DA8D38 Next payload: Hash (8) Version: 1.0 Exchange type: Quick Mode (32) Flags: 0x01 .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x17485f0b Length: 300 Encrypted payload (272 bytes) 0000 00 0c 29 48 f8 2f 00 24 b2 31 e1 3d 08 00 45 00 ..)H./.$.1.=..E. 0010 01 48 00 00 40 00 40 11 fa d6 a5 e3 f9 8a a5 e3 .H..@.@......... 0020 f9 7c 01 f4 01 f4 01 34 c0 3e a3 e7 ff d2 99 9e .|.....4.>...... 0030 6d 49 97 ec 59 f7 b4 da 8d 38 08 10 20 01 17 48 mI..Y....8.. ..H 0040 5f 0b 00 00 01 2c d6 15 d3 1e bd e2 d5 52 11 d7 _....,.......R.. 0050 f0 dd ce f6 7c e9 cc c5 56 40 fa 52 06 34 bf 18 ....|...V@.R.4.. 0060 b0 4e 95 5c 63 f9 72 9e ae 1a d2 b8 ac bb 79 04 .N.\c.r.......y. 0070 e1 51 39 5a e9 9c d5 53 85 bd 9a f4 c8 0e ed 10 .Q9Z...S........ 0080 74 9e c4 fa 79 8b 1b 91 12 1d 3b 20 e8 e9 2f fc t...y.....; ../. 0090 de d3 cb 43 f6 1c 8f 81 6b 37 32 53 d6 e5 44 97 ...C....k72S..D. 00a0 21 39 b1 f4 68 6b 1b 31 0b ef 11 b3 94 3f 53 b6 !9..hk.1.....?S. 00b0 87 14 fd 1d c5 a1 1d 41 7d f2 66 f0 5f eb 3c 73 .......A}.f._..@.7.... 0050 e2 1f 64 10 f1 3f 86 92 4b 06 72 7d ea 87 1b a3 ..d..?..K.r}.... 0060 72 6e 3a 7b e5 b1 rn:{.. Frame 20 (102 bytes on wire, 102 bytes captured) Arrival Time: May 27, 2009 16:27:55.362237000 [Time delta from previous captured frame: 0.000011000 seconds] [Time delta from previous displayed frame: 0.000011000 seconds] [Time since reference or first frame: 2.340353000 seconds] Frame Number: 20 Frame Length: 102 bytes Capture Length: 102 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f), Dst: 00:24:b2:31:e1:3d (00:24:b2:31:e1:3d) Destination: 00:24:b2:31:e1:3d (00:24:b2:31:e1:3d) Address: 00:24:b2:31:e1:3d (00:24:b2:31:e1:3d) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) Address: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.124 (165.227.249.124), Dst: 165.227.249.138 (165.227.249.138) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 88 Identification: 0x0000 (0) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfbc6 [correct] [Good: True] [Bad : False] Source: 165.227.249.124 (165.227.249.124) Destination: 165.227.249.138 (165.227.249.138) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 68 Checksum: 0x58de [correct] [Good Checksum: True] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: A3E7FFD2999E6D49 Responder cookie: 97EC59F7B4DA8D38 Next payload: Hash (8) Version: 1.0 Exchange type: Quick Mode (32) Flags: 0x01 .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x17485f0b Length: 60 Encrypted payload (32 bytes) 0000 00 24 b2 31 e1 3d 00 0c 29 48 f8 2f 08 00 45 00 .$.1.=..)H./..E. 0010 00 58 00 00 40 00 40 11 fb c6 a5 e3 f9 7c a5 e3 .X..@.@......|.. 0020 f9 8a 01 f4 01 f4 00 44 58 de a3 e7 ff d2 99 9e .......DX....... 0030 6d 49 97 ec 59 f7 b4 da 8d 38 08 10 20 01 17 48 mI..Y....8.. ..H 0040 5f 0b 00 00 00 3c ac 3e ad 40 f3 37 b6 c9 ce c8 _....<.>.@.7.... 0050 e2 1f 64 10 f1 3f 86 92 4b 06 72 7d ea 87 1b a3 ..d..?..K.r}.... 0060 72 6e 3a 7b e5 b1 rn:{.. Frame 21 (134 bytes on wire, 134 bytes captured) Arrival Time: May 27, 2009 16:27:55.643886000 [Time delta from previous captured frame: 0.281649000 seconds] [Time delta from previous displayed frame: 0.281649000 seconds] [Time since reference or first frame: 2.622002000 seconds] Frame Number: 21 Frame Length: 134 bytes Capture Length: 134 bytes [Frame is marked: False] [Protocols in frame: eth:ip:esp] Ethernet II, Src: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f), Dst: 00:24:b2:31:e1:3d (00:24:b2:31:e1:3d) Destination: 00:24:b2:31:e1:3d (00:24:b2:31:e1:3d) Address: 00:24:b2:31:e1:3d (00:24:b2:31:e1:3d) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) Address: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.124 (165.227.249.124), Dst: 165.227.249.138 (165.227.249.138) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 120 Identification: 0x0000 (0) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 240 Protocol: ESP (0x32) Header checksum: 0x8b85 [correct] [Good: True] [Bad : False] Source: 165.227.249.124 (165.227.249.124) Destination: 165.227.249.138 (165.227.249.138) Encapsulating Security Payload ESP SPI: 0x0c074336 ESP Sequence: 1 0000 00 24 b2 31 e1 3d 00 0c 29 48 f8 2f 08 00 45 00 .$.1.=..)H./..E. 0010 00 78 00 00 00 00 f0 32 8b 85 a5 e3 f9 7c a5 e3 .x.....2.....|.. 0020 f9 8a 0c 07 43 36 00 00 00 01 5f 20 2e ff 1d 47 ....C6...._ ...G 0030 e1 cf 0e 44 14 f9 8c 3b 25 4b 17 24 ae 23 fe 51 ...D...;%K.$.#.Q 0040 f8 5e 63 01 16 f0 a4 72 3b a4 1f 0a c3 01 b3 a2 .^c....r;....... 0050 cd 72 df 77 33 b7 5f 3a 1a e0 0e 86 e0 94 ee 93 .r.w3._:........ 0060 49 14 83 bd 4b 4a 92 b9 30 52 ae d0 f6 6b b6 35 I...KJ..0R...k.5 0070 01 55 34 1b 68 6c ea 2a 94 4f 9b f1 83 65 4f 0c .U4.hl.*.O...eO. 0080 ed ed d1 02 73 4f ....sO Frame 22 (134 bytes on wire, 134 bytes captured) Arrival Time: May 27, 2009 16:27:55.643899000 [Time delta from previous captured frame: 0.000013000 seconds] [Time delta from previous displayed frame: 0.000013000 seconds] [Time since reference or first frame: 2.622015000 seconds] Frame Number: 22 Frame Length: 134 bytes Capture Length: 134 bytes [Frame is marked: False] [Protocols in frame: eth:ip:esp] Ethernet II, Src: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f), Dst: 00:24:b2:31:e1:3d (00:24:b2:31:e1:3d) Destination: 00:24:b2:31:e1:3d (00:24:b2:31:e1:3d) Address: 00:24:b2:31:e1:3d (00:24:b2:31:e1:3d) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) Address: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.124 (165.227.249.124), Dst: 165.227.249.138 (165.227.249.138) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 120 Identification: 0x0000 (0) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 240 Protocol: ESP (0x32) Header checksum: 0x8b85 [correct] [Good: True] [Bad : False] Source: 165.227.249.124 (165.227.249.124) Destination: 165.227.249.138 (165.227.249.138) Encapsulating Security Payload ESP SPI: 0x0c074336 ESP Sequence: 1 0000 00 24 b2 31 e1 3d 00 0c 29 48 f8 2f 08 00 45 00 .$.1.=..)H./..E. 0010 00 78 00 00 00 00 f0 32 8b 85 a5 e3 f9 7c a5 e3 .x.....2.....|.. 0020 f9 8a 0c 07 43 36 00 00 00 01 5f 20 2e ff 1d 47 ....C6...._ ...G 0030 e1 cf 0e 44 14 f9 8c 3b 25 4b 17 24 ae 23 fe 51 ...D...;%K.$.#.Q 0040 f8 5e 63 01 16 f0 a4 72 3b a4 1f 0a c3 01 b3 a2 .^c....r;....... 0050 cd 72 df 77 33 b7 5f 3a 1a e0 0e 86 e0 94 ee 93 .r.w3._:........ 0060 49 14 83 bd 4b 4a 92 b9 30 52 ae d0 f6 6b b6 35 I...KJ..0R...k.5 0070 01 55 34 1b 68 6c ea 2a 94 4f 9b f1 83 65 4f 0c .U4.hl.*.O...eO. 0080 ed ed d1 02 73 4f ....sO Frame 23 (134 bytes on wire, 134 bytes captured) Arrival Time: May 27, 2009 16:27:58.453778000 [Time delta from previous captured frame: 2.809879000 seconds] [Time delta from previous displayed frame: 2.809879000 seconds] [Time since reference or first frame: 5.431894000 seconds] Frame Number: 23 Frame Length: 134 bytes Capture Length: 134 bytes [Frame is marked: False] [Protocols in frame: eth:ip:esp] Ethernet II, Src: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f), Dst: 00:24:b2:31:e1:3d (00:24:b2:31:e1:3d) Destination: 00:24:b2:31:e1:3d (00:24:b2:31:e1:3d) Address: 00:24:b2:31:e1:3d (00:24:b2:31:e1:3d) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) Address: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.124 (165.227.249.124), Dst: 165.227.249.138 (165.227.249.138) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 120 Identification: 0x0001 (1) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 240 Protocol: ESP (0x32) Header checksum: 0x8b84 [correct] [Good: True] [Bad : False] Source: 165.227.249.124 (165.227.249.124) Destination: 165.227.249.138 (165.227.249.138) Encapsulating Security Payload ESP SPI: 0x0c074336 ESP Sequence: 2 0000 00 24 b2 31 e1 3d 00 0c 29 48 f8 2f 08 00 45 00 .$.1.=..)H./..E. 0010 00 78 00 01 00 00 f0 32 8b 84 a5 e3 f9 7c a5 e3 .x.....2.....|.. 0020 f9 8a 0c 07 43 36 00 00 00 02 33 0a f8 68 57 26 ....C6....3..hW& 0030 43 22 50 28 c8 cb b0 c8 88 27 67 34 1d 72 1c 24 C"P(.....'g4.r.$ 0040 f7 7c d5 29 9b 39 46 43 28 45 a3 ee 80 d1 a2 65 .|.).9FC(E.....e 0050 4c 37 bb 35 c8 28 f2 35 22 6e 5d 21 0f 81 69 86 L7.5.(.5"n]!..i. 0060 0e bf fa d1 90 47 c7 e1 54 b8 aa 78 46 d6 08 04 .....G..T..xF... 0070 6c c6 77 3b 97 a1 4b 9b 12 d3 ba 72 e3 8c a6 74 l.w;..K....r...t 0080 3d ea 2a 3a aa 17 =.*:.. Frame 24 (134 bytes on wire, 134 bytes captured) Arrival Time: May 27, 2009 16:27:58.453791000 [Time delta from previous captured frame: 0.000013000 seconds] [Time delta from previous displayed frame: 0.000013000 seconds] [Time since reference or first frame: 5.431907000 seconds] Frame Number: 24 Frame Length: 134 bytes Capture Length: 134 bytes [Frame is marked: False] [Protocols in frame: eth:ip:esp] Ethernet II, Src: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f), Dst: 00:24:b2:31:e1:3d (00:24:b2:31:e1:3d) Destination: 00:24:b2:31:e1:3d (00:24:b2:31:e1:3d) Address: 00:24:b2:31:e1:3d (00:24:b2:31:e1:3d) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) Address: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.124 (165.227.249.124), Dst: 165.227.249.138 (165.227.249.138) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 120 Identification: 0x0001 (1) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 240 Protocol: ESP (0x32) Header checksum: 0x8b84 [correct] [Good: True] [Bad : False] Source: 165.227.249.124 (165.227.249.124) Destination: 165.227.249.138 (165.227.249.138) Encapsulating Security Payload ESP SPI: 0x0c074336 ESP Sequence: 2 0000 00 24 b2 31 e1 3d 00 0c 29 48 f8 2f 08 00 45 00 .$.1.=..)H./..E. 0010 00 78 00 01 00 00 f0 32 8b 84 a5 e3 f9 7c a5 e3 .x.....2.....|.. 0020 f9 8a 0c 07 43 36 00 00 00 02 33 0a f8 68 57 26 ....C6....3..hW& 0030 43 22 50 28 c8 cb b0 c8 88 27 67 34 1d 72 1c 24 C"P(.....'g4.r.$ 0040 f7 7c d5 29 9b 39 46 43 28 45 a3 ee 80 d1 a2 65 .|.).9FC(E.....e 0050 4c 37 bb 35 c8 28 f2 35 22 6e 5d 21 0f 81 69 86 L7.5.(.5"n]!..i. 0060 0e bf fa d1 90 47 c7 e1 54 b8 aa 78 46 d6 08 04 .....G..T..xF... 0070 6c c6 77 3b 97 a1 4b 9b 12 d3 ba 72 e3 8c a6 74 l.w;..K....r...t 0080 3d ea 2a 3a aa 17 =.*:.. Frame 25 (134 bytes on wire, 134 bytes captured) Arrival Time: May 27, 2009 16:27:58.458948000 [Time delta from previous captured frame: 0.005157000 seconds] [Time delta from previous displayed frame: 0.005157000 seconds] [Time since reference or first frame: 5.437064000 seconds] Frame Number: 25 Frame Length: 134 bytes Capture Length: 134 bytes [Frame is marked: False] [Protocols in frame: eth:ip:esp] Ethernet II, Src: 00:24:b2:31:e1:3d (00:24:b2:31:e1:3d), Dst: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) Destination: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) Address: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:24:b2:31:e1:3d (00:24:b2:31:e1:3d) Address: 00:24:b2:31:e1:3d (00:24:b2:31:e1:3d) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.138 (165.227.249.138), Dst: 165.227.249.124 (165.227.249.124) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 120 Identification: 0xc398 (50072) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: ESP (0x32) Header checksum: 0x77ed [correct] [Good: True] [Bad : False] Source: 165.227.249.138 (165.227.249.138) Destination: 165.227.249.124 (165.227.249.124) Encapsulating Security Payload ESP SPI: 0xe9a24044 ESP Sequence: 1 0000 00 0c 29 48 f8 2f 00 24 b2 31 e1 3d 08 00 45 00 ..)H./.$.1.=..E. 0010 00 78 c3 98 00 00 40 32 77 ed a5 e3 f9 8a a5 e3 .x....@2w....... 0020 f9 7c e9 a2 40 44 00 00 00 01 fe a5 69 0a 7e ed .|..@D......i.~. 0030 c6 1d ed 52 2a 14 d6 b2 6f 60 ca 8a 23 9d 20 6b ...R*...o`..#. k 0040 e0 1e 54 b2 5c 07 5a b4 9f e5 63 e9 c9 c6 57 6d ..T.\.Z...c...Wm 0050 37 ac 87 59 9e b7 4d 61 3a 9d bc 42 b2 5d 35 90 7..Y..Ma:..B.]5. 0060 8f 00 b9 fb 63 d5 58 dc 4b b8 d1 0c 16 52 fc 60 ....c.X.K....R.` 0070 7f 6b be a6 f2 a3 30 23 a9 3f b4 c7 af fe 54 2c .k....0#.?....T, 0080 7d 12 6a 94 4b a9 }.j.K. Frame 26 (134 bytes on wire, 134 bytes captured) Arrival Time: May 27, 2009 16:27:59.453341000 [Time delta from previous captured frame: 0.994393000 seconds] [Time delta from previous displayed frame: 0.994393000 seconds] [Time since reference or first frame: 6.431457000 seconds] Frame Number: 26 Frame Length: 134 bytes Capture Length: 134 bytes [Frame is marked: False] [Protocols in frame: eth:ip:esp] Ethernet II, Src: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f), Dst: 00:24:b2:31:e1:3d (00:24:b2:31:e1:3d) Destination: 00:24:b2:31:e1:3d (00:24:b2:31:e1:3d) Address: 00:24:b2:31:e1:3d (00:24:b2:31:e1:3d) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) Address: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.124 (165.227.249.124), Dst: 165.227.249.138 (165.227.249.138) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 120 Identification: 0x0002 (2) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 240 Protocol: ESP (0x32) Header checksum: 0x8b83 [correct] [Good: True] [Bad : False] Source: 165.227.249.124 (165.227.249.124) Destination: 165.227.249.138 (165.227.249.138) Encapsulating Security Payload ESP SPI: 0x0c074336 ESP Sequence: 3 0000 00 24 b2 31 e1 3d 00 0c 29 48 f8 2f 08 00 45 00 .$.1.=..)H./..E. 0010 00 78 00 02 00 00 f0 32 8b 83 a5 e3 f9 7c a5 e3 .x.....2.....|.. 0020 f9 8a 0c 07 43 36 00 00 00 03 8c 8a e6 d3 a1 a3 ....C6.......... 0030 9c fb 92 c3 51 d6 62 31 cc 5b 9a 53 33 70 75 65 ....Q.b1.[.S3pue 0040 44 cc 57 23 e7 f8 a3 91 b3 ba 2a 53 c4 0f 8f f2 D.W#......*S.... 0050 b2 b3 56 c5 1f 53 ce d8 e7 fb f8 26 1d 26 1c 84 ..V..S.....&.&.. 0060 d6 98 0c 7d 0a 03 03 5f 12 fa 21 52 96 73 5b d1 ...}..._..!R.s[. 0070 93 a4 c0 86 58 e0 04 2c 2d 89 4b df 0c 05 48 6c ....X..,-.K...Hl 0080 60 f6 00 d6 03 c3 `..... Frame 27 (134 bytes on wire, 134 bytes captured) Arrival Time: May 27, 2009 16:27:59.453353000 [Time delta from previous captured frame: 0.000012000 seconds] [Time delta from previous displayed frame: 0.000012000 seconds] [Time since reference or first frame: 6.431469000 seconds] Frame Number: 27 Frame Length: 134 bytes Capture Length: 134 bytes [Frame is marked: False] [Protocols in frame: eth:ip:esp] Ethernet II, Src: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f), Dst: 00:24:b2:31:e1:3d (00:24:b2:31:e1:3d) Destination: 00:24:b2:31:e1:3d (00:24:b2:31:e1:3d) Address: 00:24:b2:31:e1:3d (00:24:b2:31:e1:3d) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) Address: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.124 (165.227.249.124), Dst: 165.227.249.138 (165.227.249.138) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 120 Identification: 0x0002 (2) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 240 Protocol: ESP (0x32) Header checksum: 0x8b83 [correct] [Good: True] [Bad : False] Source: 165.227.249.124 (165.227.249.124) Destination: 165.227.249.138 (165.227.249.138) Encapsulating Security Payload ESP SPI: 0x0c074336 ESP Sequence: 3 0000 00 24 b2 31 e1 3d 00 0c 29 48 f8 2f 08 00 45 00 .$.1.=..)H./..E. 0010 00 78 00 02 00 00 f0 32 8b 83 a5 e3 f9 7c a5 e3 .x.....2.....|.. 0020 f9 8a 0c 07 43 36 00 00 00 03 8c 8a e6 d3 a1 a3 ....C6.......... 0030 9c fb 92 c3 51 d6 62 31 cc 5b 9a 53 33 70 75 65 ....Q.b1.[.S3pue 0040 44 cc 57 23 e7 f8 a3 91 b3 ba 2a 53 c4 0f 8f f2 D.W#......*S.... 0050 b2 b3 56 c5 1f 53 ce d8 e7 fb f8 26 1d 26 1c 84 ..V..S.....&.&.. 0060 d6 98 0c 7d 0a 03 03 5f 12 fa 21 52 96 73 5b d1 ...}..._..!R.s[. 0070 93 a4 c0 86 58 e0 04 2c 2d 89 4b df 0c 05 48 6c ....X..,-.K...Hl 0080 60 f6 00 d6 03 c3 `..... Frame 28 (134 bytes on wire, 134 bytes captured) Arrival Time: May 27, 2009 16:27:59.457603000 [Time delta from previous captured frame: 0.004250000 seconds] [Time delta from previous displayed frame: 0.004250000 seconds] [Time since reference or first frame: 6.435719000 seconds] Frame Number: 28 Frame Length: 134 bytes Capture Length: 134 bytes [Frame is marked: False] [Protocols in frame: eth:ip:esp] Ethernet II, Src: 00:24:b2:31:e1:3d (00:24:b2:31:e1:3d), Dst: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) Destination: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) Address: 00:0c:29:48:f8:2f (00:0c:29:48:f8:2f) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:24:b2:31:e1:3d (00:24:b2:31:e1:3d) Address: 00:24:b2:31:e1:3d (00:24:b2:31:e1:3d) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.138 (165.227.249.138), Dst: 165.227.249.124 (165.227.249.124) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 120 Identification: 0x4954 (18772) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: ESP (0x32) Header checksum: 0xf231 [correct] [Good: True] [Bad : False] Source: 165.227.249.138 (165.227.249.138) Destination: 165.227.249.124 (165.227.249.124) Encapsulating Security Payload ESP SPI: 0xe9a24044 ESP Sequence: 2 0000 00 0c 29 48 f8 2f 00 24 b2 31 e1 3d 08 00 45 00 ..)H./.$.1.=..E. 0010 00 78 49 54 00 00 40 32 f2 31 a5 e3 f9 8a a5 e3 .xIT..@2.1...... 0020 f9 7c e9 a2 40 44 00 00 00 02 17 f5 58 48 b8 f6 .|..@D......XH.. 0030 d2 81 ae ab 3e cb c2 12 d0 62 21 67 cb 41 3b 53 ....>....b!g.A;S 0040 87 ba f2 74 86 f4 58 91 e5 08 dd 56 07 2d 43 c7 ...t..X....V.-C. 0050 ec 34 c0 ea ef a8 98 da 4a 0e e5 71 ed df 85 ff .4......J..q.... 0060 2e 18 40 ee 87 16 db 2a 64 89 4a 10 1b 54 f1 d9 ..@....*d.J..T.. 0070 6d 3f e8 9d 7e a2 d6 fd 31 8f 27 aa 9d e6 f2 e0 m?..~...1.'..... 0080 28 fe 1e cb d9 40 (....@