Frame 1 (270 bytes on wire, 270 bytes captured) Arrival Time: Mar 23, 2004 16:09:00.489835000 Time delta from previous packet: 0.000000000 seconds Time since reference or first frame: 0.000000000 seconds Frame Number: 1 Packet Length: 270 bytes Capture Length: 270 bytes Ethernet II, Src: 00:0c:29:e6:ad:b9, Dst: 00:d0:cf:01:f5:33 Destination: 00:d0:cf:01:f5:33 (00:d0:cf:01:f5:33) Source: 00:0c:29:e6:ad:b9 (00:0c:29:e6:ad:b9) Type: IP (0x0800) Frame check sequence: 0xfe0eb79c (correct) Internet Protocol, Src Addr: 165.227.249.124 (165.227.249.124), Dst Addr: 165.227.249.139 (165.227.249.139) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 252 Identification: 0x0b6f (2927) Flags: 0x00 .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0x2fb3 (correct) Source: 165.227.249.124 (165.227.249.124) Destination: 165.227.249.139 (165.227.249.139) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 232 Checksum: 0xb83b (correct) Internet Security Association and Key Management Protocol Initiator cookie: 0x1CDA70F79D6BE5D9 Responder cookie: 0x0000000000000000 Next payload: Security Association (1) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...0 = No encryption .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 224 Security Association payload Next payload: Vendor ID (13) Length: 56 Domain of interpretation: IPSEC (1) Situation: IDENTITY (1) Proposal payload # 0 Next payload: NONE (0) Length: 44 Proposal number: 0 Protocol ID: ISAKMP (1) SPI size: 0 Number of transforms: 1 Transform payload # 0 Next payload: NONE (0) Length: 36 Transform number: 0 Transform ID: KEY_IKE (1) Encryption-Algorithm (1): AES-CBC (7) Key-Length (14): Key-Length (128) Hash-Algorithm (2): SHA (2) Authentication-Method (3): PSK (1) Group-Description (4): Alternate 1024-bit MODP group (2) Life-Type (11): Seconds (1) Life-Duration (12): Duration-Value (28800) Vendor ID payload Next payload: Vendor ID (13) Length: 20 Vendor ID: unknown vendor ID: 0x8F9CC94E01248ECDF147594C284B213B Vendor ID payload Next payload: Vendor ID (13) Length: 20 Vendor ID: draft-stenberg-ipsec-nat-traversal-01 Vendor ID payload Next payload: Vendor ID (13) Length: 20 Vendor ID: draft-stenberg-ipsec-nat-traversal-02 Vendor ID payload Next payload: Vendor ID (13) Length: 20 Vendor ID: draft-ietf-ipsec-nat-t-ike-00 Vendor ID payload Next payload: Vendor ID (13) Length: 20 Vendor ID: draft-ietf-ipsec-nat-t-ike-02 Vendor ID payload Next payload: Vendor ID (13) Length: 20 Vendor ID: draft-ietf-ipsec-nat-t-ike-02 Vendor ID payload Next payload: NONE (0) Length: 20 Vendor ID: draft-ietf-ipsec-nat-t-ike-03 0000 00 d0 cf 01 f5 33 00 0c 29 e6 ad b9 08 00 45 00 .....3..).....E. 0010 00 fc 0b 6f 00 00 40 11 2f b3 a5 e3 f9 7c a5 e3 ...o..@./....|.. 0020 f9 8b 01 f4 01 f4 00 e8 b8 3b 1c da 70 f7 9d 6b .........;..p..k 0030 e5 d9 00 00 00 00 00 00 00 00 01 10 02 00 00 00 ................ 0040 00 00 00 00 00 e0 0d 00 00 38 00 00 00 01 00 00 .........8...... 0050 00 01 00 00 00 2c 00 01 00 01 00 00 00 24 00 01 .....,.......$.. 0060 00 00 80 01 00 07 80 0e 00 80 80 02 00 02 80 03 ................ 0070 00 01 80 04 00 02 80 0b 00 01 80 0c 70 80 0d 00 ............p... 0080 00 14 8f 9c c9 4e 01 24 8e cd f1 47 59 4c 28 4b .....N.$...GYL(K 0090 21 3b 0d 00 00 14 27 ba b5 dc 01 ea 07 60 ea 4e !;....'......`.N 00a0 31 90 ac 27 c0 d0 0d 00 00 14 61 05 c4 22 e7 68 1..'......a..".h 00b0 47 e4 3f 96 84 80 12 92 ae cd 0d 00 00 14 44 85 G.?...........D. 00c0 15 2d 18 b6 bb cd 0b e8 a8 46 95 79 dd cc 0d 00 .-.......F.y.... 00d0 00 14 cd 60 46 43 35 df 21 f8 7c fd b2 fc 68 b6 ...`FC5.!.|...h. 00e0 a4 48 0d 00 00 14 90 cb 80 91 3e bb 69 6e 08 63 .H........>.in.c 00f0 81 b5 ec 42 7b 1f 00 00 00 14 7d 94 19 a6 53 10 ...B{.....}...S. 0100 ca 6f 2c 17 9d 92 15 52 9d 56 fe 0e b7 9c .o,....R.V.... Frame 2 (170 bytes on wire, 170 bytes captured) Arrival Time: Mar 23, 2004 16:09:00.497495000 Time delta from previous packet: 0.007660000 seconds Time since reference or first frame: 0.007660000 seconds Frame Number: 2 Packet Length: 170 bytes Capture Length: 170 bytes Ethernet II, Src: 00:d0:cf:01:f5:33, Dst: 00:0c:29:e6:ad:b9 Destination: 00:0c:29:e6:ad:b9 (00:0c:29:e6:ad:b9) Source: 00:d0:cf:01:f5:33 (00:d0:cf:01:f5:33) Type: IP (0x0800) Frame check sequence: 0xa7fe8a3b (correct) Internet Protocol, Src Addr: 165.227.249.139 (165.227.249.139), Dst Addr: 165.227.249.124 (165.227.249.124) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 152 Identification: 0x0000 (0) Flags: 0x04 .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfb85 (correct) Source: 165.227.249.139 (165.227.249.139) Destination: 165.227.249.124 (165.227.249.124) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 132 Checksum: 0x3d2a (correct) Internet Security Association and Key Management Protocol Initiator cookie: 0x1CDA70F79D6BE5D9 Responder cookie: 0xD8AA383433488D13 Next payload: Security Association (1) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...0 = No encryption .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 124 Security Association payload Next payload: Vendor ID (13) Length: 56 Domain of interpretation: IPSEC (1) Situation: IDENTITY (1) Proposal payload # 0 Next payload: NONE (0) Length: 44 Proposal number: 0 Protocol ID: ISAKMP (1) SPI size: 0 Number of transforms: 1 Transform payload # 0 Next payload: NONE (0) Length: 36 Transform number: 0 Transform ID: KEY_IKE (1) Encryption-Algorithm (1): AES-CBC (7) Key-Length (14): Key-Length (128) Hash-Algorithm (2): SHA (2) Authentication-Method (3): PSK (1) Group-Description (4): Alternate 1024-bit MODP group (2) Life-Type (11): Seconds (1) Life-Duration (12): Duration-Value (28800) Vendor ID payload Next payload: Vendor ID (13) Length: 20 Vendor ID: draft-ietf-ipsec-nat-t-ike-03 Vendor ID payload Next payload: NONE (0) Length: 20 Vendor ID: draft-ietf-ipsec-dpd-00.txt 0000 00 0c 29 e6 ad b9 00 d0 cf 01 f5 33 08 00 45 00 ..)........3..E. 0010 00 98 00 00 40 00 40 11 fb 85 a5 e3 f9 8b a5 e3 ....@.@......... 0020 f9 7c 01 f4 01 f4 00 84 3d 2a 1c da 70 f7 9d 6b .|......=*..p..k 0030 e5 d9 d8 aa 38 34 33 48 8d 13 01 10 02 00 00 00 ....843H........ 0040 00 00 00 00 00 7c 0d 00 00 38 00 00 00 01 00 00 .....|...8...... 0050 00 01 00 00 00 2c 00 01 00 01 00 00 00 24 00 01 .....,.......$.. 0060 00 00 80 01 00 07 80 0e 00 80 80 02 00 02 80 03 ................ 0070 00 01 80 04 00 02 80 0b 00 01 80 0c 70 80 0d 00 ............p... 0080 00 14 7d 94 19 a6 53 10 ca 6f 2c 17 9d 92 15 52 ..}...S..o,....R 0090 9d 56 00 00 00 14 af ca d7 13 68 a1 f1 c9 6b 86 .V........h...k. 00a0 96 fc 77 57 01 00 a7 fe 8a 3b ..wW.....; Frame 3 (274 bytes on wire, 274 bytes captured) Arrival Time: Mar 23, 2004 16:09:00.504305000 Time delta from previous packet: 0.006810000 seconds Time since reference or first frame: 0.014470000 seconds Frame Number: 3 Packet Length: 274 bytes Capture Length: 274 bytes Ethernet II, Src: 00:0c:29:e6:ad:b9, Dst: 00:d0:cf:01:f5:33 Destination: 00:d0:cf:01:f5:33 (00:d0:cf:01:f5:33) Source: 00:0c:29:e6:ad:b9 (00:0c:29:e6:ad:b9) Type: IP (0x0800) Frame check sequence: 0x11af317f (correct) Internet Protocol, Src Addr: 165.227.249.124 (165.227.249.124), Dst Addr: 165.227.249.139 (165.227.249.139) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 256 Identification: 0x0b70 (2928) Flags: 0x00 .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0x2fae (correct) Source: 165.227.249.124 (165.227.249.124) Destination: 165.227.249.139 (165.227.249.139) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 236 Checksum: 0xad41 (correct) Internet Security Association and Key Management Protocol Initiator cookie: 0x1CDA70F79D6BE5D9 Responder cookie: 0xD8AA383433488D13 Next payload: Key Exchange (4) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...0 = No encryption .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 228 Key Exchange payload Next payload: Nonce (10) Length: 132 Key Exchange Data Nonce payload Next payload: Private USE (130) Length: 20 Nonce Data Unknown payload type payload Next payload: Private USE (130) Length: 24 Payload Unknown payload type payload Next payload: NONE (0) Length: 24 Payload 0000 00 d0 cf 01 f5 33 00 0c 29 e6 ad b9 08 00 45 00 .....3..).....E. 0010 01 00 0b 70 00 00 40 11 2f ae a5 e3 f9 7c a5 e3 ...p..@./....|.. 0020 f9 8b 01 f4 01 f4 00 ec ad 41 1c da 70 f7 9d 6b .........A..p..k 0030 e5 d9 d8 aa 38 34 33 48 8d 13 04 10 02 00 00 00 ....843H........ 0040 00 00 00 00 00 e4 0a 00 00 84 e2 da e8 d0 c9 a7 ................ 0050 a9 b6 97 f3 4e 97 a3 30 0f df 7e ec 36 4e 76 4a ....N..0..~.6NvJ 0060 b7 06 a6 34 a9 10 df 5e e2 d9 09 a6 68 5a 08 5c ...4...^....hZ.\ 0070 d1 f8 dd 20 9a ff 63 be 96 8d 82 e0 e6 26 55 1b ... ..c......&U. 0080 48 93 5e 16 e7 20 39 e4 16 d7 80 a9 8c 89 6e ed H.^.. 9.......n. 0090 d8 8f 91 24 b6 a2 6d 45 b8 61 3c d4 97 8c ec 94 ...$..mE.a<..... 00a0 25 fa 5f a1 30 e0 ba 69 6c 77 52 18 c1 a7 70 9c %._.0..ilwR...p. 00b0 15 29 75 8a ec 67 f4 4a e1 76 48 d7 0e 53 a3 b3 .)u..g.J.vH..S.. 00c0 84 33 a3 af 83 fc 3e ec d7 f1 82 00 00 14 d3 1e .3....>......... 00d0 af 64 4c 5f 23 26 a8 bd f3 94 65 39 2f be 82 00 .dL_#&....e9/... 00e0 00 18 cd 5f 0a 49 26 f4 98 c0 99 6a f9 e5 a4 f9 ..._.I&....j.... 00f0 66 58 d5 08 d8 4f 00 00 00 18 a8 5c af f0 1a 89 fX...O.....\.... 0100 2d 57 e2 06 63 95 8c 2c bb 70 20 dd a9 bd 11 af -W..c..,.p ..... 0110 31 7f 1. Frame 4 (274 bytes on wire, 274 bytes captured) Arrival Time: Mar 23, 2004 16:09:00.785638000 Time delta from previous packet: 0.281333000 seconds Time since reference or first frame: 0.295803000 seconds Frame Number: 4 Packet Length: 274 bytes Capture Length: 274 bytes Ethernet II, Src: 00:d0:cf:01:f5:33, Dst: 00:0c:29:e6:ad:b9 Destination: 00:0c:29:e6:ad:b9 (00:0c:29:e6:ad:b9) Source: 00:d0:cf:01:f5:33 (00:d0:cf:01:f5:33) Type: IP (0x0800) Frame check sequence: 0x901b4eb9 (correct) Internet Protocol, Src Addr: 165.227.249.139 (165.227.249.139), Dst Addr: 165.227.249.124 (165.227.249.124) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 256 Identification: 0x0000 (0) Flags: 0x04 .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfb1d (correct) Source: 165.227.249.139 (165.227.249.139) Destination: 165.227.249.124 (165.227.249.124) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 236 Checksum: 0x0d8b (correct) Internet Security Association and Key Management Protocol Initiator cookie: 0x1CDA70F79D6BE5D9 Responder cookie: 0xD8AA383433488D13 Next payload: Key Exchange (4) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...0 = No encryption .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 228 Key Exchange payload Next payload: Nonce (10) Length: 132 Key Exchange Data Nonce payload Next payload: Private USE (130) Length: 20 Nonce Data Unknown payload type payload Next payload: Private USE (130) Length: 24 Payload Unknown payload type payload Next payload: NONE (0) Length: 24 Payload 0000 00 0c 29 e6 ad b9 00 d0 cf 01 f5 33 08 00 45 00 ..)........3..E. 0010 01 00 00 00 40 00 40 11 fb 1d a5 e3 f9 8b a5 e3 ....@.@......... 0020 f9 7c 01 f4 01 f4 00 ec 0d 8b 1c da 70 f7 9d 6b .|..........p..k 0030 e5 d9 d8 aa 38 34 33 48 8d 13 04 10 02 00 00 00 ....843H........ 0040 00 00 00 00 00 e4 0a 00 00 84 be 8f c3 a9 73 6c ..............sl 0050 32 99 c1 8d ac 23 a8 d0 f7 4b 83 3d 56 67 6a 3b 2....#...K.=Vgj; 0060 36 3a 65 c1 b5 cb a6 75 b6 1a 18 ee b3 e6 33 24 6:e....u......3$ 0070 2c f5 6c 8f a3 89 5c ff a9 fb 26 a6 55 b7 17 ca ,.l...\...&.U... 0080 cd 13 da c0 10 ad c5 c9 fb 6e c7 60 52 61 0b 9b .........n.`Ra.. 0090 cf 01 41 b4 f6 be e6 5b a5 e1 4f 73 74 1a 8f d8 ..A....[..Ost... 00a0 25 99 80 0b f0 cc 44 00 04 6f c3 7b e4 f1 25 ae %.....D..o.{..%. 00b0 64 29 d6 db 54 3f da e8 dd fc 05 aa 2e 90 61 07 d)..T?........a. 00c0 dc e9 5e a7 94 e3 c6 33 20 76 82 00 00 14 59 e4 ..^....3 v....Y. 00d0 89 4d 8c 43 e8 1b f6 75 cf 8c c2 65 32 49 82 00 .M.C...u...e2I.. 00e0 00 18 a8 5c af f0 1a 89 2d 57 e2 06 63 95 8c 2c ...\....-W..c.., 00f0 bb 70 20 dd a9 bd 00 00 00 18 cd 5f 0a 49 26 f4 .p ........_.I&. 0100 98 c0 99 6a f9 e5 a4 f9 66 58 d5 08 d8 4f 90 1b ...j....fX...O.. 0110 4e b9 N. Frame 5 (122 bytes on wire, 122 bytes captured) Arrival Time: Mar 23, 2004 16:09:00.792152000 Time delta from previous packet: 0.006514000 seconds Time since reference or first frame: 0.302317000 seconds Frame Number: 5 Packet Length: 122 bytes Capture Length: 122 bytes Ethernet II, Src: 00:0c:29:e6:ad:b9, Dst: 00:d0:cf:01:f5:33 Destination: 00:d0:cf:01:f5:33 (00:d0:cf:01:f5:33) Source: 00:0c:29:e6:ad:b9 (00:0c:29:e6:ad:b9) Type: IP (0x0800) Frame check sequence: 0x46f21239 (correct) Internet Protocol, Src Addr: 165.227.249.124 (165.227.249.124), Dst Addr: 165.227.249.139 (165.227.249.139) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 104 Identification: 0x0b71 (2929) Flags: 0x00 .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0x3045 (correct) Source: 165.227.249.124 (165.227.249.124) Destination: 165.227.249.139 (165.227.249.139) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 84 Checksum: 0xbf23 (correct) Internet Security Association and Key Management Protocol Initiator cookie: 0x1CDA70F79D6BE5D9 Responder cookie: 0xD8AA383433488D13 Next payload: Identification (5) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...1 = Encryption .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 76 Encrypted payload (48 bytes) 0000 00 d0 cf 01 f5 33 00 0c 29 e6 ad b9 08 00 45 00 .....3..).....E. 0010 00 68 0b 71 00 00 40 11 30 45 a5 e3 f9 7c a5 e3 .h.q..@.0E...|.. 0020 f9 8b 01 f4 01 f4 00 54 bf 23 1c da 70 f7 9d 6b .......T.#..p..k 0030 e5 d9 d8 aa 38 34 33 48 8d 13 05 10 02 01 00 00 ....843H........ 0040 00 00 00 00 00 4c 58 ae 07 bc c5 6a 55 90 e6 4e .....LX....jU..N 0050 65 6b c8 27 66 e2 e6 d7 e4 01 f2 61 7b 73 7a 7c ek.'f......a{sz| 0060 34 7e f6 62 2d 04 d1 30 6b c3 6b 10 27 1a bb 5c 4~.b-..0k.k.'..\ 0070 d7 29 14 94 9c 47 46 f2 12 39 .)...GF..9 Frame 6 (122 bytes on wire, 122 bytes captured) Arrival Time: Mar 23, 2004 16:09:00.796078000 Time delta from previous packet: 0.003926000 seconds Time since reference or first frame: 0.306243000 seconds Frame Number: 6 Packet Length: 122 bytes Capture Length: 122 bytes Ethernet II, Src: 00:d0:cf:01:f5:33, Dst: 00:0c:29:e6:ad:b9 Destination: 00:0c:29:e6:ad:b9 (00:0c:29:e6:ad:b9) Source: 00:d0:cf:01:f5:33 (00:d0:cf:01:f5:33) Type: IP (0x0800) Frame check sequence: 0x0560810e (correct) Internet Protocol, Src Addr: 165.227.249.139 (165.227.249.139), Dst Addr: 165.227.249.124 (165.227.249.124) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 104 Identification: 0x0000 (0) Flags: 0x04 .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfbb5 (correct) Source: 165.227.249.139 (165.227.249.139) Destination: 165.227.249.124 (165.227.249.124) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 84 Checksum: 0x6d86 (correct) Internet Security Association and Key Management Protocol Initiator cookie: 0x1CDA70F79D6BE5D9 Responder cookie: 0xD8AA383433488D13 Next payload: Identification (5) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...1 = Encryption .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 76 Encrypted payload (48 bytes) 0000 00 0c 29 e6 ad b9 00 d0 cf 01 f5 33 08 00 45 00 ..)........3..E. 0010 00 68 00 00 40 00 40 11 fb b5 a5 e3 f9 8b a5 e3 .h..@.@......... 0020 f9 7c 01 f4 01 f4 00 54 6d 86 1c da 70 f7 9d 6b .|.....Tm...p..k 0030 e5 d9 d8 aa 38 34 33 48 8d 13 05 10 02 01 00 00 ....843H........ 0040 00 00 00 00 00 4c d4 77 a8 cb 33 c3 0b 13 70 31 .....L.w..3...p1 0050 11 43 6f 4d cd 6e bd d8 3c ef f5 67 51 b4 63 a3 .CoM.n..<..gQ.c. 0060 1c 8c f7 e9 31 15 01 42 59 33 4b 73 1c 59 21 1c ....1..BY3Ks.Y!. 0070 cf fe 7c ca cf d4 05 60 81 0e ..|....`.. Frame 7 (346 bytes on wire, 346 bytes captured) Arrival Time: Mar 23, 2004 16:09:00.805331000 Time delta from previous packet: 0.009253000 seconds Time since reference or first frame: 0.315496000 seconds Frame Number: 7 Packet Length: 346 bytes Capture Length: 346 bytes Ethernet II, Src: 00:0c:29:e6:ad:b9, Dst: 00:d0:cf:01:f5:33 Destination: 00:d0:cf:01:f5:33 (00:d0:cf:01:f5:33) Source: 00:0c:29:e6:ad:b9 (00:0c:29:e6:ad:b9) Type: IP (0x0800) Frame check sequence: 0x45bfa220 (correct) Internet Protocol, Src Addr: 165.227.249.124 (165.227.249.124), Dst Addr: 165.227.249.139 (165.227.249.139) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 328 Identification: 0x0b72 (2930) Flags: 0x00 .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0x2f64 (correct) Source: 165.227.249.124 (165.227.249.124) Destination: 165.227.249.139 (165.227.249.139) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 308 Checksum: 0xdf3a (correct) Internet Security Association and Key Management Protocol Initiator cookie: 0x1CDA70F79D6BE5D9 Responder cookie: 0xD8AA383433488D13 Next payload: Hash (8) Version: 1.0 Exchange type: Quick Mode (32) Flags .... ...1 = Encryption .... ..0. = No commit .... .0.. = No authentication Message ID: 0xD4D24E19 Length: 300 Encrypted payload (272 bytes) 0000 00 d0 cf 01 f5 33 00 0c 29 e6 ad b9 08 00 45 00 .....3..).....E. 0010 01 48 0b 72 00 00 40 11 2f 64 a5 e3 f9 7c a5 e3 .H.r..@./d...|.. 0020 f9 8b 01 f4 01 f4 01 34 df 3a 1c da 70 f7 9d 6b .......4.:..p..k 0030 e5 d9 d8 aa 38 34 33 48 8d 13 08 10 20 01 d4 d2 ....843H.... ... 0040 4e 19 00 00 01 2c 74 c6 2e a4 dc 0e 2f fb 8a 5e N....,t...../..^ 0050 9e 01 de e1 81 90 e8 33 f2 66 14 1c ab 53 61 ce .......3.f...Sa. 0060 2a 27 27 b9 72 73 3e e8 84 b0 ba c2 c3 c5 c5 22 *''.rs>........" 0070 45 28 5a ac e7 0e d6 49 98 a0 53 9a 84 69 23 25 E(Z....I..S..i#% 0080 4f 73 4d d9 b6 26 53 0f 91 a6 ef de 79 ee 98 3d OsM..&S.....y..= 0090 c2 04 5f c4 fb 2a 62 9d ac af d1 08 e2 9a 33 15 .._..*b.......3. 00a0 03 44 5e eb ef 92 59 b7 06 73 56 9f 02 65 91 2b .D^...Y..sV..e.+ 00b0 55 27 83 5b ef 34 68 43 a2 74 87 95 60 da 47 66 U'.[.4hC.t..`.Gf 00c0 8d c7 1d d7 83 67 1b 2b e6 fa 9e 15 e4 9a 35 c9 .....g.+......5. 00d0 77 60 b5 59 2a 4f f3 e6 b3 1e 03 5b 0d 87 15 c0 w`.Y*O.....[.... 00e0 64 f3 c2 e7 86 a7 5c 41 2d 70 2f 0a ad 33 fb 23 d.....\A-p/..3.# 00f0 e5 47 2b ad 37 d0 2e a6 18 5f 3c 48 b3 73 a2 34 .G+.7...._v.3.*...$...,. 0070 0d 7d ac 5c 20 58 bf ba 72 97 9b 29 20 b9 1a d0 .}.\ X..r..) ... 0080 fb d7 c3 df 96 3c f6 1f b3 f8 a2 45 7a 84 bb bb .....<.....Ez... 0090 bc 4f b8 a2 43 23 cd db 9d 95 a9 c7 78 19 34 16 .O..C#......x.4. 00a0 c5 40 38 ea 7d 1c f5 58 15 91 f0 6d ea 14 71 cc .@8.}..X...m..q. 00b0 f2 d0 90 61 20 91 10 ee c0 f1 b0 0a a4 79 e3 0a ...a ........y.. 00c0 8d 88 a9 76 df 64 22 b8 59 04 55 f3 9a 5d a8 82 ...v.d".Y.U..].. 00d0 de 14 ee fb 33 d3 a5 fb 91 a1 5d cc 52 14 78 fd ....3.....].R.x. 00e0 1e f9 b0 39 b5 af 55 ab 56 f9 14 a1 9c 81 d3 14 ...9..U.V....... 00f0 c3 7a e9 99 71 87 f9 f6 c9 5d b6 d9 b9 2b 05 f6 .z..q....]...+.. 0100 c8 47 15 55 51 83 a5 a3 ce e9 30 24 e2 68 01 78 .G.UQ.....0$.h.x 0110 d9 49 ce bc 8d 7a 4d 5a 2f 31 42 d7 92 3b 4a 20 .I...zMZ/1B..;J 0120 88 11 87 eb ea 1f 59 1a e5 1f 85 b3 6b 91 a6 b6 ......Y.....k... 0130 64 9b 3d 72 1d 19 73 b7 31 60 50 ce cb a3 0e 61 d.=r..s.1`P....a 0140 eb 7a e0 54 2b 33 6c de 25 e7 10 cd 86 5f d8 0b .z.T+3l.%...._.. 0150 75 d4 e2 98 94 45 73 48 2d 84 u....EsH-. Frame 9 (106 bytes on wire, 106 bytes captured) Arrival Time: Mar 23, 2004 16:09:01.104793000 Time delta from previous packet: 0.009344000 seconds Time since reference or first frame: 0.614958000 seconds Frame Number: 9 Packet Length: 106 bytes Capture Length: 106 bytes Ethernet II, Src: 00:0c:29:e6:ad:b9, Dst: 00:d0:cf:01:f5:33 Destination: 00:d0:cf:01:f5:33 (00:d0:cf:01:f5:33) Source: 00:0c:29:e6:ad:b9 (00:0c:29:e6:ad:b9) Type: IP (0x0800) Frame check sequence: 0x66ad249a (correct) Internet Protocol, Src Addr: 165.227.249.124 (165.227.249.124), Dst Addr: 165.227.249.139 (165.227.249.139) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 88 Identification: 0x0b73 (2931) Flags: 0x00 .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0x3053 (correct) Source: 165.227.249.124 (165.227.249.124) Destination: 165.227.249.139 (165.227.249.139) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 68 Checksum: 0xf009 (correct) Internet Security Association and Key Management Protocol Initiator cookie: 0x1CDA70F79D6BE5D9 Responder cookie: 0xD8AA383433488D13 Next payload: Hash (8) Version: 1.0 Exchange type: Quick Mode (32) Flags .... ...1 = Encryption .... ..0. = No commit .... .0.. = No authentication Message ID: 0xD4D24E19 Length: 60 Encrypted payload (32 bytes) 0000 00 d0 cf 01 f5 33 00 0c 29 e6 ad b9 08 00 45 00 .....3..).....E. 0010 00 58 0b 73 00 00 40 11 30 53 a5 e3 f9 7c a5 e3 .X.s..@.0S...|.. 0020 f9 8b 01 f4 01 f4 00 44 f0 09 1c da 70 f7 9d 6b .......D....p..k 0030 e5 d9 d8 aa 38 34 33 48 8d 13 08 10 20 01 d4 d2 ....843H.... ... 0040 4e 19 00 00 00 3c 13 de 9d d0 5d c1 ae a8 18 02 N....<....]..... 0050 2f 44 ff d2 52 21 5e 0e 51 e0 a0 8d 7f 0b fd 83 /D..R!^.Q....... 0060 df 51 06 12 95 56 66 ad 24 9a .Q...Vf.$. Frame 10 (170 bytes on wire, 170 bytes captured) Arrival Time: Mar 23, 2004 16:09:01.365167000 Time delta from previous packet: 0.260374000 seconds Time since reference or first frame: 0.875332000 seconds Frame Number: 10 Packet Length: 170 bytes Capture Length: 170 bytes Ethernet II, Src: 00:0c:29:e6:ad:b9, Dst: 00:d0:cf:01:f5:33 Destination: 00:d0:cf:01:f5:33 (00:d0:cf:01:f5:33) Source: 00:0c:29:e6:ad:b9 (00:0c:29:e6:ad:b9) Type: IP (0x0800) Frame check sequence: 0x22c3e38e (correct) Internet Protocol, Src Addr: 165.227.249.124 (165.227.249.124), Dst Addr: 165.227.249.139 (165.227.249.139) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 152 Identification: 0x0065 (101) Flags: 0x00 .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 240 Protocol: ESP (0x32) Header checksum: 0x8aff (correct) Source: 165.227.249.124 (165.227.249.124) Destination: 165.227.249.139 (165.227.249.139) Encapsulating Security Payload SPI: 0x9e9652b2 Sequence: 2 Data (124 bytes) 0000 00 d0 cf 01 f5 33 00 0c 29 e6 ad b9 08 00 45 00 .....3..).....E. 0010 00 98 00 65 00 00 f0 32 8a ff a5 e3 f9 7c a5 e3 ...e...2.....|.. 0020 f9 8b 9e 96 52 b2 00 00 00 02 4b 5b 22 46 8d 17 ....R.....K["F.. 0030 45 34 92 95 c2 8e 8e 3b 8a 90 a0 f2 60 e7 df af E4.....;....`... 0040 9d f5 25 1a 5d cf d7 1b ca 37 2b cd 69 44 ed a4 ..%.]....7+.iD.. 0050 4e 70 44 2e 52 10 89 4c 80 79 34 61 d0 d3 0e 58 NpD.R..L.y4a...X 0060 05 54 96 02 ea 47 29 92 16 13 60 9b 10 3d 00 cc .T...G)...`..=.. 0070 c7 b4 8c 84 74 c0 98 dc da 4d 5d 01 56 16 9d b0 ....t....M].V... 0080 87 52 cd 17 65 e2 e0 90 37 db f9 68 74 0a 42 48 .R..e...7..ht.BH 0090 75 04 db 35 2a 1d a1 f9 a9 c3 06 06 b6 b8 57 b2 u..5*.........W. 00a0 98 fb dc 32 b2 35 22 c3 e3 8e ...2.5"... Frame 11 (170 bytes on wire, 170 bytes captured) Arrival Time: Mar 23, 2004 16:09:01.494071000 Time delta from previous packet: 0.128904000 seconds Time since reference or first frame: 1.004236000 seconds Frame Number: 11 Packet Length: 170 bytes Capture Length: 170 bytes Ethernet II, Src: 00:0c:29:e6:ad:b9, Dst: 00:d0:cf:01:f5:33 Destination: 00:d0:cf:01:f5:33 (00:d0:cf:01:f5:33) Source: 00:0c:29:e6:ad:b9 (00:0c:29:e6:ad:b9) Type: IP (0x0800) Frame check sequence: 0xcc5c1aea (correct) Internet Protocol, Src Addr: 165.227.249.124 (165.227.249.124), Dst Addr: 165.227.249.139 (165.227.249.139) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 152 Identification: 0x0066 (102) Flags: 0x00 .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 240 Protocol: ESP (0x32) Header checksum: 0x8afe (correct) Source: 165.227.249.124 (165.227.249.124) Destination: 165.227.249.139 (165.227.249.139) Encapsulating Security Payload SPI: 0x9e9652b2 Sequence: 3 Data (124 bytes) 0000 00 d0 cf 01 f5 33 00 0c 29 e6 ad b9 08 00 45 00 .....3..).....E. 0010 00 98 00 66 00 00 f0 32 8a fe a5 e3 f9 7c a5 e3 ...f...2.....|.. 0020 f9 8b 9e 96 52 b2 00 00 00 03 5f bf ea df 85 02 ....R....._..... 0030 e2 0c 9e ae 75 f8 e1 1f 10 24 e4 45 24 9e 35 bf ....u....$.E$.5. 0040 47 6f 32 1f 39 26 c1 8e 28 0d c6 6a 67 75 2e 56 Go2.9&..(..jgu.V 0050 31 52 27 ee 92 a0 8a 42 7a e7 94 64 a7 11 ab 94 1R'....Bz..d.... 0060 1b 63 04 7c c0 df ed 42 82 36 73 ad e1 75 cd 86 .c.|...B.6s..u.. 0070 6c c3 c9 3e fe e5 d5 6f 6f 7c 32 29 46 11 e3 e6 l..>...oo|2)F... 0080 ad f0 a5 c7 91 52 34 e3 6e 87 43 b7 e8 ac e4 be .....R4.n.C..... 0090 82 38 6c 56 a9 71 77 64 18 b4 3d 64 4b 4b f8 90 .8lV.qwd..=dKK.. 00a0 9c f5 a6 2c 52 86 cc 5c 1a ea ...,R..\.. Frame 12 (170 bytes on wire, 170 bytes captured) Arrival Time: Mar 23, 2004 16:09:02.474601000 Time delta from previous packet: 0.980530000 seconds Time since reference or first frame: 1.984766000 seconds Frame Number: 12 Packet Length: 170 bytes Capture Length: 170 bytes Ethernet II, Src: 00:0c:29:e6:ad:b9, Dst: 00:d0:cf:01:f5:33 Destination: 00:d0:cf:01:f5:33 (00:d0:cf:01:f5:33) Source: 00:0c:29:e6:ad:b9 (00:0c:29:e6:ad:b9) Type: IP (0x0800) Frame check sequence: 0xe3f7b754 (correct) Internet Protocol, Src Addr: 165.227.249.124 (165.227.249.124), Dst Addr: 165.227.249.139 (165.227.249.139) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 152 Identification: 0x0067 (103) Flags: 0x00 .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 240 Protocol: ESP (0x32) Header checksum: 0x8afd (correct) Source: 165.227.249.124 (165.227.249.124) Destination: 165.227.249.139 (165.227.249.139) Encapsulating Security Payload SPI: 0x9e9652b2 Sequence: 4 Data (124 bytes) 0000 00 d0 cf 01 f5 33 00 0c 29 e6 ad b9 08 00 45 00 .....3..).....E. 0010 00 98 00 67 00 00 f0 32 8a fd a5 e3 f9 7c a5 e3 ...g...2.....|.. 0020 f9 8b 9e 96 52 b2 00 00 00 04 ea 4c 89 27 3f b0 ....R......L.'?. 0030 89 d0 47 af d3 5b 9f 96 d7 e6 5f 0e 50 65 e3 17 ..G..[...._.Pe.. 0040 29 87 41 ab 8e f9 dc ea 43 0c 01 d0 48 b0 ac cf ).A.....C...H... 0050 68 5a 76 29 7e 3f 13 cb d2 d7 01 fb ba 93 69 1a hZv)~?........i. 0060 54 34 f5 63 7b 7d 2d bc 5b 12 20 70 0d c0 2d b9 T4.c{}-.[. p..-. 0070 44 9f 73 43 15 95 9e 75 ee eb e0 a9 5e 08 d1 6c D.sC...u....^..l 0080 35 73 c8 8e 39 6d 6c 3d 43 55 4f b1 19 05 53 7b 5s..9ml=CUO...S{ 0090 9b 0c 4b f8 9e f4 f2 b9 7d 0a 51 46 26 d2 f2 07 ..K.....}.QF&... 00a0 15 68 87 50 fb e0 e3 f7 b7 54 .h.P.....T Frame 13 (170 bytes on wire, 170 bytes captured) Arrival Time: Mar 23, 2004 16:09:03.513259000 Time delta from previous packet: 1.038658000 seconds Time since reference or first frame: 3.023424000 seconds Frame Number: 13 Packet Length: 170 bytes Capture Length: 170 bytes Ethernet II, Src: 00:0c:29:e6:ad:b9, Dst: 00:d0:cf:01:f5:33 Destination: 00:d0:cf:01:f5:33 (00:d0:cf:01:f5:33) Source: 00:0c:29:e6:ad:b9 (00:0c:29:e6:ad:b9) Type: IP (0x0800) Frame check sequence: 0x903d6c84 (correct) Internet Protocol, Src Addr: 165.227.249.124 (165.227.249.124), Dst Addr: 165.227.249.139 (165.227.249.139) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 152 Identification: 0x0068 (104) Flags: 0x00 .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 240 Protocol: ESP (0x32) Header checksum: 0x8afc (correct) Source: 165.227.249.124 (165.227.249.124) Destination: 165.227.249.139 (165.227.249.139) Encapsulating Security Payload SPI: 0x9e9652b2 Sequence: 5 Data (124 bytes) 0000 00 d0 cf 01 f5 33 00 0c 29 e6 ad b9 08 00 45 00 .....3..).....E. 0010 00 98 00 68 00 00 f0 32 8a fc a5 e3 f9 7c a5 e3 ...h...2.....|.. 0020 f9 8b 9e 96 52 b2 00 00 00 05 7d 37 2e f7 67 52 ....R.....}7..gR 0030 f2 a7 87 ea e3 ff e7 16 ca ff 6c 3f 92 20 36 f7 ..........l?. 6. 0040 09 8b 62 9a f5 cf 2f 39 6c ad 66 ed 3a a9 60 a2 ..b.../9l.f.:.`. 0050 fd 96 bc 36 7b 45 9a 89 c3 90 2d 97 6c f1 8f de ...6{E....-.l... 0060 17 f1 47 9e 61 56 60 05 75 ab 71 91 3e 89 09 f4 ..G.aV`.u.q.>... 0070 fe 1e 89 e5 db a5 26 61 4d 38 cb 7b 54 7b 00 95 ......&aM8.{T{.. 0080 dd 54 5c e8 8c 90 32 2a 19 aa 55 71 ea d9 f2 36 .T\...2*..Uq...6 0090 3c 94 40 c0 82 7d cf ff 8d 23 76 3f 60 56 0a d3 <.@..}...#v?`V.. 00a0 77 ff ad 02 59 5a 90 3d 6c 84 w...YZ.=l. Frame 14 (170 bytes on wire, 170 bytes captured) Arrival Time: Mar 23, 2004 16:09:03.515229000 Time delta from previous packet: 0.001970000 seconds Time since reference or first frame: 3.025394000 seconds Frame Number: 14 Packet Length: 170 bytes Capture Length: 170 bytes Ethernet II, Src: 00:d0:cf:01:f5:33, Dst: 00:0c:29:e6:ad:b9 Destination: 00:0c:29:e6:ad:b9 (00:0c:29:e6:ad:b9) Source: 00:d0:cf:01:f5:33 (00:d0:cf:01:f5:33) Type: IP (0x0800) Frame check sequence: 0x6b56b5f8 (correct) Internet Protocol, Src Addr: 165.227.249.139 (165.227.249.139), Dst Addr: 165.227.249.124 (165.227.249.124) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 152 Identification: 0x4326 (17190) Flags: 0x00 .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: ESP (0x32) Header checksum: 0xf83e (correct) Source: 165.227.249.139 (165.227.249.139) Destination: 165.227.249.124 (165.227.249.124) Encapsulating Security Payload SPI: 0xef75f120 Sequence: 1 Data (124 bytes) 0000 00 0c 29 e6 ad b9 00 d0 cf 01 f5 33 08 00 45 00 ..)........3..E. 0010 00 98 43 26 00 00 40 32 f8 3e a5 e3 f9 8b a5 e3 ..C&..@2.>...... 0020 f9 7c ef 75 f1 20 00 00 00 01 21 2f a2 a0 a4 62 .|.u. ....!/...b 0030 d1 9e dc 87 e8 e8 0f 25 78 3d cb 50 ad f3 94 a3 .......%x=.P.... 0040 a8 82 6d 80 a3 f2 cc 36 4f 86 4a f2 b0 97 c1 53 ..m....6O.J....S 0050 ba 6c b6 a9 7f 52 87 12 59 36 70 62 d5 35 b6 7c .l...R..Y6pb.5.| 0060 00 06 69 04 ec fa d4 4d 42 7a 0a 41 8f d4 ec 63 ..i....MBz.A...c 0070 59 b8 88 52 08 77 49 82 37 05 62 0c 49 dc b1 e2 Y..R.wI.7.b.I... 0080 f5 6f 20 24 e5 2f 6e 64 eb f9 4c 27 01 7d 75 6d .o $./nd..L'.}um 0090 ca 67 1d 1c ec 54 43 e3 91 f2 c7 6a 73 ac 41 30 .g...TC....js.A0 00a0 df 5d 94 93 d8 4d 6b 56 b5 f8 .]...MkV..