Frame 1 (266 bytes on wire, 266 bytes captured) Arrival Time: Jan 21, 2006 16:02:12.010242000 Time delta from previous packet: 0.000000000 seconds Time since reference or first frame: 0.000000000 seconds Frame Number: 1 Packet Length: 266 bytes Capture Length: 266 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:0c:29:f4:af:90 (00:0c:29:f4:af:90), Dst: 00:13:c4:80:d3:aa (00:13:c4:80:d3:aa) Destination: 00:13:c4:80:d3:aa (00:13:c4:80:d3:aa) Source: 00:0c:29:f4:af:90 (00:0c:29:f4:af:90) Type: IP (0x0800) Trailer: 87FACA29 Internet Protocol, Src: 165.227.249.124 (165.227.249.124), Dst: 165.227.249.147 (165.227.249.147) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 248 Identification: 0x00bc (188) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0x3a62 [correct] Good: True Bad : False Source: 165.227.249.124 (165.227.249.124) Destination: 165.227.249.147 (165.227.249.147) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 228 Checksum: 0xb32d [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0xD194C105E77B1CAF Responder cookie: 0x0000000000000000 Next payload: Security Association (1) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 220 Security Association payload Next payload: Vendor ID (13) Length: 52 Domain of interpretation: IPSEC (1) Situation: IDENTITY (1) Proposal payload # 0 Next payload: NONE (0) Length: 40 Proposal number: 0 Protocol ID: ISAKMP (1) SPI size: 0 Number of transforms: 1 Transform payload # 0 Next payload: NONE (0) Length: 32 Transform number: 0 Transform ID: KEY_IKE (1) Encryption-Algorithm (1): 3DES-CBC (5) Hash-Algorithm (2): SHA (2) Authentication-Method (3): PSK (1) Group-Description (4): Alternate 1024-bit MODP group (2) Life-Type (11): Seconds (1) Life-Duration (12): Duration-Value (28800) Vendor ID payload Next payload: Vendor ID (13) Length: 20 Vendor ID: unknown vendor ID: 0x8F9CC94E01248ECDF147594C284B213B Vendor ID payload Next payload: Vendor ID (13) Length: 20 Vendor ID: draft-stenberg-ipsec-nat-traversal-01 Vendor ID payload Next payload: Vendor ID (13) Length: 20 Vendor ID: draft-stenberg-ipsec-nat-traversal-02 Vendor ID payload Next payload: Vendor ID (13) Length: 20 Vendor ID: draft-ietf-ipsec-nat-t-ike-00 Vendor ID payload Next payload: Vendor ID (13) Length: 20 Vendor ID: draft-ietf-ipsec-nat-t-ike-02 Vendor ID payload Next payload: Vendor ID (13) Length: 20 Vendor ID: draft-ietf-ipsec-nat-t-ike-02 Vendor ID payload Next payload: NONE (0) Length: 20 Vendor ID: draft-ietf-ipsec-nat-t-ike-03 0000 00 13 c4 80 d3 aa 00 0c 29 f4 af 90 08 00 45 00 ........).....E. 0010 00 f8 00 bc 00 00 40 11 3a 62 a5 e3 f9 7c a5 e3 ......@.:b...|.. 0020 f9 93 01 f4 01 f4 00 e4 b3 2d d1 94 c1 05 e7 7b .........-.....{ 0030 1c af 00 00 00 00 00 00 00 00 01 10 02 00 00 00 ................ 0040 00 00 00 00 00 dc 0d 00 00 34 00 00 00 01 00 00 .........4...... 0050 00 01 00 00 00 28 00 01 00 01 00 00 00 20 00 01 .....(....... .. 0060 00 00 80 01 00 05 80 02 00 02 80 03 00 01 80 04 ................ 0070 00 02 80 0b 00 01 80 0c 70 80 0d 00 00 14 8f 9c ........p....... 0080 c9 4e 01 24 8e cd f1 47 59 4c 28 4b 21 3b 0d 00 .N.$...GYL(K!;.. 0090 00 14 27 ba b5 dc 01 ea 07 60 ea 4e 31 90 ac 27 ..'......`.N1..' 00a0 c0 d0 0d 00 00 14 61 05 c4 22 e7 68 47 e4 3f 96 ......a..".hG.?. 00b0 84 80 12 92 ae cd 0d 00 00 14 44 85 15 2d 18 b6 ..........D..-.. 00c0 bb cd 0b e8 a8 46 95 79 dd cc 0d 00 00 14 cd 60 .....F.y.......` 00d0 46 43 35 df 21 f8 7c fd b2 fc 68 b6 a4 48 0d 00 FC5.!.|...h..H.. 00e0 00 14 90 cb 80 91 3e bb 69 6e 08 63 81 b5 ec 42 ......>.in.c...B 00f0 7b 1f 00 00 00 14 7d 94 19 a6 53 10 ca 6f 2c 17 {.....}...S..o,. 0100 9d 92 15 52 9d 56 87 fa ca 29 ...R.V...) Frame 2 (150 bytes on wire, 150 bytes captured) Arrival Time: Jan 21, 2006 16:02:12.011306000 Time delta from previous packet: 0.001064000 seconds Time since reference or first frame: 0.001064000 seconds Frame Number: 2 Packet Length: 150 bytes Capture Length: 150 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:13:c4:80:d3:aa (00:13:c4:80:d3:aa), Dst: 00:0c:29:f4:af:90 (00:0c:29:f4:af:90) Destination: 00:0c:29:f4:af:90 (00:0c:29:f4:af:90) Source: 00:13:c4:80:d3:aa (00:13:c4:80:d3:aa) Type: IP (0x0800) Trailer: 3F10791B Internet Protocol, Src: 165.227.249.147 (165.227.249.147), Dst: 165.227.249.124 (165.227.249.124) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 132 Identification: 0x2d7b (11643) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 255 Protocol: UDP (0x11) Header checksum: 0x4f16 [correct] Good: True Bad : False Source: 165.227.249.147 (165.227.249.147) Destination: 165.227.249.124 (165.227.249.124) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 112 Checksum: 0x70a9 [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0xD194C105E77B1CAF Responder cookie: 0x0458B5454CB75458 Next payload: Security Association (1) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 104 Security Association payload Next payload: Vendor ID (13) Length: 52 Domain of interpretation: IPSEC (1) Situation: IDENTITY (1) Proposal payload # 1 Next payload: NONE (0) Length: 40 Proposal number: 1 Protocol ID: ISAKMP (1) SPI size: 0 Number of transforms: 1 Transform payload # 0 Next payload: NONE (0) Length: 32 Transform number: 0 Transform ID: KEY_IKE (1) Encryption-Algorithm (1): 3DES-CBC (5) Hash-Algorithm (2): SHA (2) Group-Description (4): Alternate 1024-bit MODP group (2) Authentication-Method (3): PSK (1) Life-Type (11): Seconds (1) Life-Duration (12): Duration-Value (28800) Vendor ID payload Next payload: NONE (0) Length: 24 Vendor ID: Microsoft L2TP/IPSec VPN Client 0000 00 0c 29 f4 af 90 00 13 c4 80 d3 aa 08 00 45 00 ..)...........E. 0010 00 84 2d 7b 00 00 ff 11 4f 16 a5 e3 f9 93 a5 e3 ..-{....O....... 0020 f9 7c 01 f4 01 f4 00 70 70 a9 d1 94 c1 05 e7 7b .|.....pp......{ 0030 1c af 04 58 b5 45 4c b7 54 58 01 10 02 00 00 00 ...X.EL.TX...... 0040 00 00 00 00 00 68 0d 00 00 34 00 00 00 01 00 00 .....h...4...... 0050 00 01 00 00 00 28 01 01 00 01 00 00 00 20 00 01 .....(....... .. 0060 00 00 80 01 00 05 80 02 00 02 80 04 00 02 80 03 ................ 0070 00 01 80 0b 00 01 80 0c 70 80 00 00 00 18 40 48 ........p.....@H 0080 b7 d5 6e bc e8 85 25 e7 de 7f 00 d6 c2 d3 c0 00 ..n...%......... 0090 00 00 3f 10 79 1b ..?.y. Frame 3 (226 bytes on wire, 226 bytes captured) Arrival Time: Jan 21, 2006 16:02:12.022589000 Time delta from previous packet: 0.011283000 seconds Time since reference or first frame: 0.012347000 seconds Frame Number: 3 Packet Length: 226 bytes Capture Length: 226 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:0c:29:f4:af:90 (00:0c:29:f4:af:90), Dst: 00:13:c4:80:d3:aa (00:13:c4:80:d3:aa) Destination: 00:13:c4:80:d3:aa (00:13:c4:80:d3:aa) Source: 00:0c:29:f4:af:90 (00:0c:29:f4:af:90) Type: IP (0x0800) Trailer: 23349B79 Internet Protocol, Src: 165.227.249.124 (165.227.249.124), Dst: 165.227.249.147 (165.227.249.147) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 208 Identification: 0x00bd (189) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0x3a89 [correct] Good: True Bad : False Source: 165.227.249.124 (165.227.249.124) Destination: 165.227.249.147 (165.227.249.147) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 188 Checksum: 0xf2b0 [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0xD194C105E77B1CAF Responder cookie: 0x0458B5454CB75458 Next payload: Key Exchange (4) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 180 Key Exchange payload Next payload: Nonce (10) Length: 132 Key Exchange Data Nonce payload Next payload: NONE (0) Length: 20 Nonce Data 0000 00 13 c4 80 d3 aa 00 0c 29 f4 af 90 08 00 45 00 ........).....E. 0010 00 d0 00 bd 00 00 40 11 3a 89 a5 e3 f9 7c a5 e3 ......@.:....|.. 0020 f9 93 01 f4 01 f4 00 bc f2 b0 d1 94 c1 05 e7 7b ...............{ 0030 1c af 04 58 b5 45 4c b7 54 58 04 10 02 00 00 00 ...X.EL.TX...... 0040 00 00 00 00 00 b4 0a 00 00 84 6c 56 1a 62 a8 a6 ..........lV.b.. 0050 40 8d b2 08 80 2b b6 82 be ff fa fc c6 b8 d6 7d @....+.........} 0060 42 2f 8a b6 af 25 14 88 ea d6 d2 79 81 21 01 4a B/...%.....y.!.J 0070 8c f7 84 24 95 fe 4e 97 cf 9f 27 ae a0 8e 91 35 ...$..N...'....5 0080 03 f6 9c 85 33 4c 2c 74 bb a5 1a 01 c5 96 c1 10 ....3L,t........ 0090 ea 1a 91 f5 e6 a6 79 db b4 bd 71 1c 61 22 a2 0e ......y...q.a".. 00a0 6b 5b c2 b8 2d a9 0c 81 b5 be 78 d6 02 54 c6 4b k[..-.....x..T.K 00b0 4e 85 cf b1 dc 9d 32 37 1f dc 89 be 56 e6 ec 2b N.....27....V..+ 00c0 b1 b8 94 64 73 92 33 c6 81 eb 00 00 00 14 69 17 ...ds.3.......i. 00d0 36 0b b6 ec 73 32 02 07 3d 32 0f 0f c5 0b 23 34 6...s2..=2....#4 00e0 9b 79 .y Frame 4 (302 bytes on wire, 302 bytes captured) Arrival Time: Jan 21, 2006 16:02:12.024146000 Time delta from previous packet: 0.001557000 seconds Time since reference or first frame: 0.013904000 seconds Frame Number: 4 Packet Length: 302 bytes Capture Length: 302 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:13:c4:80:d3:aa (00:13:c4:80:d3:aa), Dst: 00:0c:29:f4:af:90 (00:0c:29:f4:af:90) Destination: 00:0c:29:f4:af:90 (00:0c:29:f4:af:90) Source: 00:13:c4:80:d3:aa (00:13:c4:80:d3:aa) Type: IP (0x0800) Trailer: EB0D3106 Internet Protocol, Src: 165.227.249.147 (165.227.249.147), Dst: 165.227.249.124 (165.227.249.124) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 284 Identification: 0x2d7c (11644) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 255 Protocol: UDP (0x11) Header checksum: 0x4e7d [correct] Good: True Bad : False Source: 165.227.249.147 (165.227.249.147) Destination: 165.227.249.124 (165.227.249.124) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 264 Checksum: 0x742c [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0xD194C105E77B1CAF Responder cookie: 0x0458B5454CB75458 Next payload: Key Exchange (4) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 256 Key Exchange payload Next payload: Nonce (10) Length: 132 Key Exchange Data Nonce payload Next payload: Vendor ID (13) Length: 24 Nonce Data Vendor ID payload Next payload: Vendor ID (13) Length: 20 Vendor ID: unknown vendor ID: 0x12F5F28C457168A9702D9FE274CC0100 Vendor ID payload Next payload: Vendor ID (13) Length: 12 Vendor ID: draft-beaulieu-ike-xauth-02.txt Vendor ID payload Next payload: Vendor ID (13) Length: 20 Vendor ID: unknown vendor ID: 0xF19F12584CB65458630DB537E6F18FEC Vendor ID payload Next payload: NONE (0) Length: 20 Vendor ID: unknown vendor ID: 0x1F07F70EAA6514D3B0FA96542A500100 0000 00 0c 29 f4 af 90 00 13 c4 80 d3 aa 08 00 45 00 ..)...........E. 0010 01 1c 2d 7c 00 00 ff 11 4e 7d a5 e3 f9 93 a5 e3 ..-|....N}...... 0020 f9 7c 01 f4 01 f4 01 08 74 2c d1 94 c1 05 e7 7b .|......t,.....{ 0030 1c af 04 58 b5 45 4c b7 54 58 04 10 02 00 00 00 ...X.EL.TX...... 0040 00 00 00 00 01 00 0a 00 00 84 4c b0 ac fe 99 c2 ..........L..... 0050 cc fb a9 dd cd f5 46 13 25 7a d7 7a 8e eb 1e ad ......F.%z.z.... 0060 bd 2c 7c 81 66 40 1d 03 eb 90 a9 a9 4e 04 c7 e1 .,|.f@......N... 0070 16 be 04 80 93 4e 87 79 e8 64 0e 33 49 b3 7b d2 .....N.y.d.3I.{. 0080 dc 88 51 85 1b f0 a1 f3 72 1e d8 63 6e 80 6f 5b ..Q.....r..cn.o[ 0090 32 c6 d3 a9 95 16 53 32 c8 21 01 ef d5 7c cd 0d 2.....S2.!...|.. 00a0 6e 9d 2c c5 9f b6 f8 2b 53 26 24 64 4b f4 a4 0b n.,....+S&$dK... 00b0 1e be c1 7e b2 f7 a9 02 5b dd 8d ed 27 55 ca fb ...~....[...'U.. 00c0 42 36 d3 71 a3 2d f1 6b b6 fe 0d 00 00 18 fa 07 B6.q.-.k........ 00d0 cb 80 33 88 ad 5f d1 cb 29 9c a0 10 7a 8e 82 7c ..3.._..)...z..| 00e0 ad 72 0d 00 00 14 12 f5 f2 8c 45 71 68 a9 70 2d .r........Eqh.p- 00f0 9f e2 74 cc 01 00 0d 00 00 0c 09 00 26 89 df d6 ..t.........&... 0100 b7 12 0d 00 00 14 f1 9f 12 58 4c b6 54 58 63 0d .........XL.TXc. 0110 b5 37 e6 f1 8f ec 00 00 00 14 1f 07 f7 0e aa 65 .7.............e 0120 14 d3 b0 fa 96 54 2a 50 01 00 eb 0d 31 06 .....T*P....1. Frame 5 (122 bytes on wire, 122 bytes captured) Arrival Time: Jan 21, 2006 16:02:12.031818000 Time delta from previous packet: 0.007672000 seconds Time since reference or first frame: 0.021576000 seconds Frame Number: 5 Packet Length: 122 bytes Capture Length: 122 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:0c:29:f4:af:90 (00:0c:29:f4:af:90), Dst: 00:13:c4:80:d3:aa (00:13:c4:80:d3:aa) Destination: 00:13:c4:80:d3:aa (00:13:c4:80:d3:aa) Source: 00:0c:29:f4:af:90 (00:0c:29:f4:af:90) Type: IP (0x0800) Trailer: 42C76F80 Internet Protocol, Src: 165.227.249.124 (165.227.249.124), Dst: 165.227.249.147 (165.227.249.147) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 104 Identification: 0x00be (190) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0x3af0 [correct] Good: True Bad : False Source: 165.227.249.124 (165.227.249.124) Destination: 165.227.249.147 (165.227.249.147) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 84 Checksum: 0x812e [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0xD194C105E77B1CAF Responder cookie: 0x0458B5454CB75458 Next payload: Identification (5) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 76 Encrypted payload (48 bytes) 0000 00 13 c4 80 d3 aa 00 0c 29 f4 af 90 08 00 45 00 ........).....E. 0010 00 68 00 be 00 00 40 11 3a f0 a5 e3 f9 7c a5 e3 .h....@.:....|.. 0020 f9 93 01 f4 01 f4 00 54 81 2e d1 94 c1 05 e7 7b .......T.......{ 0030 1c af 04 58 b5 45 4c b7 54 58 05 10 02 01 00 00 ...X.EL.TX...... 0040 00 00 00 00 00 4c 62 64 47 33 0a 35 fa 1f aa a0 .....LbdG3.5.... 0050 02 ea 93 41 2e 67 a3 be ef 7c eb 69 1a d6 15 1a ...A.g...|.i.... 0060 4b 24 ea fd c0 eb 88 e6 62 db f5 34 c7 1f dc 98 K$......b..4.... 0070 28 66 52 0a 80 a4 42 c7 6f 80 (fR...B.o. Frame 6 (130 bytes on wire, 130 bytes captured) Arrival Time: Jan 21, 2006 16:02:12.032714000 Time delta from previous packet: 0.000896000 seconds Time since reference or first frame: 0.022472000 seconds Frame Number: 6 Packet Length: 130 bytes Capture Length: 130 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:13:c4:80:d3:aa (00:13:c4:80:d3:aa), Dst: 00:0c:29:f4:af:90 (00:0c:29:f4:af:90) Destination: 00:0c:29:f4:af:90 (00:0c:29:f4:af:90) Source: 00:13:c4:80:d3:aa (00:13:c4:80:d3:aa) Type: IP (0x0800) Trailer: 7BD9ABD7 Internet Protocol, Src: 165.227.249.147 (165.227.249.147), Dst: 165.227.249.124 (165.227.249.124) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 112 Identification: 0x2d7d (11645) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 255 Protocol: UDP (0x11) Header checksum: 0x4f28 [correct] Good: True Bad : False Source: 165.227.249.147 (165.227.249.147) Destination: 165.227.249.124 (165.227.249.124) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 92 Checksum: 0xd443 [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0xD194C105E77B1CAF Responder cookie: 0x0458B5454CB75458 Next payload: Identification (5) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 84 Encrypted payload (56 bytes) 0000 00 0c 29 f4 af 90 00 13 c4 80 d3 aa 08 00 45 00 ..)...........E. 0010 00 70 2d 7d 00 00 ff 11 4f 28 a5 e3 f9 93 a5 e3 .p-}....O(...... 0020 f9 7c 01 f4 01 f4 00 5c d4 43 d1 94 c1 05 e7 7b .|.....\.C.....{ 0030 1c af 04 58 b5 45 4c b7 54 58 05 10 02 01 00 00 ...X.EL.TX...... 0040 00 00 00 00 00 54 8b c0 70 21 e8 15 18 4c 6c 2e .....T..p!...Ll. 0050 fa ac c8 a1 6a f4 27 aa fd 63 a2 be b6 70 bf 6a ....j.'..c...p.j 0060 eb a9 11 64 be 1d 5a 6a 3f 1e bd d4 b3 3e 63 c3 ...d..Zj?....>c. 0070 9d 5f f2 b0 5e 48 1f 69 a4 1b 55 f2 e9 a1 7b d9 ._..^H.i..U...{. 0080 ab d7 .. Frame 7 (338 bytes on wire, 338 bytes captured) Arrival Time: Jan 21, 2006 16:02:12.042834000 Time delta from previous packet: 0.010120000 seconds Time since reference or first frame: 0.032592000 seconds Frame Number: 7 Packet Length: 338 bytes Capture Length: 338 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:0c:29:f4:af:90 (00:0c:29:f4:af:90), Dst: 00:13:c4:80:d3:aa (00:13:c4:80:d3:aa) Destination: 00:13:c4:80:d3:aa (00:13:c4:80:d3:aa) Source: 00:0c:29:f4:af:90 (00:0c:29:f4:af:90) Type: IP (0x0800) Trailer: 867EF0D3 Internet Protocol, Src: 165.227.249.124 (165.227.249.124), Dst: 165.227.249.147 (165.227.249.147) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 320 Identification: 0x00bf (191) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0x3a17 [correct] Good: True Bad : False Source: 165.227.249.124 (165.227.249.124) Destination: 165.227.249.147 (165.227.249.147) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 300 Checksum: 0xf86f [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0xD194C105E77B1CAF Responder cookie: 0x0458B5454CB75458 Next payload: Hash (8) Version: 1.0 Exchange type: Quick Mode (32) Flags .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x748A2F63 Length: 292 Encrypted payload (264 bytes) 0000 00 13 c4 80 d3 aa 00 0c 29 f4 af 90 08 00 45 00 ........).....E. 0010 01 40 00 bf 00 00 40 11 3a 17 a5 e3 f9 7c a5 e3 .@....@.:....|.. 0020 f9 93 01 f4 01 f4 01 2c f8 6f d1 94 c1 05 e7 7b .......,.o.....{ 0030 1c af 04 58 b5 45 4c b7 54 58 08 10 20 01 74 8a ...X.EL.TX.. .t. 0040 2f 63 00 00 01 24 38 eb 1e e9 8d 1d f4 32 88 df /c...$8......2.. 0050 a0 87 67 8b 43 a0 60 c3 84 c0 9d 38 ee 55 99 bf ..g.C.`....8.U.. 0060 d3 e0 e8 e7 b6 77 13 de 21 f7 d9 c3 19 05 17 7a .....w..!......z 0070 67 84 36 cf 7d c1 4f a3 9a db fc 8f b7 42 76 c6 g.6.}.O......Bv. 0080 32 f2 ef b0 35 eb 48 5f ed a7 d9 ba b3 89 0e 6b 2...5.H_.......k 0090 77 a2 28 76 98 7e bc 5c 6c ba f2 ee 21 6d c3 44 w.(v.~.\l...!m.D 00a0 94 35 5c 4f 0a 0b ac ac 8c ea 7f 1e d9 66 87 45 .5\O.........f.E 00b0 82 92 b8 90 ca 80 4a 47 2a 8e 64 d2 24 17 cc 54 ......JG*.d.$..T 00c0 43 99 34 0d 72 82 66 f0 73 34 b4 93 b1 11 bc b9 C.4.r.f.s4...... 00d0 b4 fd 93 ea 1b 00 fc 76 6d ed d8 a0 0e 91 87 cc .......vm....... 00e0 37 92 14 8d 9c 11 83 40 e5 99 65 1e 3a 70 b1 19 7......@..e.:p.. 00f0 d2 2b fa 1a 58 c5 9f 52 79 f0 10 d3 f9 3e ca 56 .+..X..Ry....>.V 0100 dd 9b 2f 68 0d ee ff f3 4f 89 72 66 28 82 5b 91 ../h....O.rf(.[. 0110 8e b1 c5 70 c5 f1 ad 9b 30 62 a0 4f ff 12 44 47 ...p....0b.O..DG 0120 ed 39 d6 5c 7e ce 5d 95 6c bd 2e 71 cb 2c 5d 42 .9.\~.].l..q.,]B 0130 d8 7c a6 27 5f e8 7f 25 0e 89 e2 e6 3c 00 af ef .|.'_..%....<... 0140 4f 5c 89 d3 16 16 c0 1b c4 9b 35 4b c2 86 86 7e O\........5K...~ 0150 f0 d3 .. Frame 8 (338 bytes on wire, 338 bytes captured) Arrival Time: Jan 21, 2006 16:02:12.045617000 Time delta from previous packet: 0.002783000 seconds Time since reference or first frame: 0.035375000 seconds Frame Number: 8 Packet Length: 338 bytes Capture Length: 338 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:13:c4:80:d3:aa (00:13:c4:80:d3:aa), Dst: 00:0c:29:f4:af:90 (00:0c:29:f4:af:90) Destination: 00:0c:29:f4:af:90 (00:0c:29:f4:af:90) Source: 00:13:c4:80:d3:aa (00:13:c4:80:d3:aa) Type: IP (0x0800) Trailer: D702E1DF Internet Protocol, Src: 165.227.249.147 (165.227.249.147), Dst: 165.227.249.124 (165.227.249.124) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 320 Identification: 0x2d7e (11646) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 255 Protocol: UDP (0x11) Header checksum: 0x4e57 [correct] Good: True Bad : False Source: 165.227.249.147 (165.227.249.147) Destination: 165.227.249.124 (165.227.249.124) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 300 Checksum: 0x0253 [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0xD194C105E77B1CAF Responder cookie: 0x0458B5454CB75458 Next payload: Hash (8) Version: 1.0 Exchange type: Quick Mode (32) Flags .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x748A2F63 Length: 292 Encrypted payload (264 bytes) 0000 00 0c 29 f4 af 90 00 13 c4 80 d3 aa 08 00 45 00 ..)...........E. 0010 01 40 2d 7e 00 00 ff 11 4e 57 a5 e3 f9 93 a5 e3 .@-~....NW...... 0020 f9 7c 01 f4 01 f4 01 2c 02 53 d1 94 c1 05 e7 7b .|.....,.S.....{ 0030 1c af 04 58 b5 45 4c b7 54 58 08 10 20 01 74 8a ...X.EL.TX.. .t. 0040 2f 63 00 00 01 24 e0 cd ac 52 aa a7 15 f6 ee 7b /c...$...R.....{ 0050 fc 29 6b 52 ba c3 8e 92 67 cb 88 bc 0e 5b a3 06 .)kR....g....[.. 0060 d8 54 d6 0c 07 de 9b 64 ed d5 82 83 20 ac ca 07 .T.....d.... ... 0070 36 aa c0 41 4b 3c 1b 81 e2 01 73 20 2b 88 57 68 6..AK<....s +.Wh 0080 c9 d3 32 d8 e5 6c 62 d0 95 fd b0 21 1e 1f 24 93 ..2..lb....!..$. 0090 89 5f 1a 11 91 ca 9b 33 57 22 ad 4c 3d 81 c5 08 ._.....3W".L=... 00a0 62 55 21 0b df 9b 0e ec 3c 16 c2 4f 8e 30 d5 48 bU!.....<..O.0.H 00b0 2c d7 ea d7 d5 e1 2e 1c cd 62 b8 86 c6 52 9a 0e ,........b...R.. 00c0 95 4b 60 2c a6 31 c1 67 07 f1 29 f2 63 15 e0 a0 .K`,.1.g..).c... 00d0 a2 29 3c d3 f5 23 4e 7c 6a d3 cb 74 71 cd d0 84 .)<..#N|j..tq... 00e0 d0 9e 4a 69 8f fd 76 af e3 6f a8 70 60 69 4b 31 ..Ji..v..o.p`iK1 00f0 0b 63 d7 1c 70 58 b7 e4 92 f5 39 66 05 7f af 91 .c..pX....9f.... 0100 47 b7 49 26 6e e6 4e 1d 68 2e 6d 4d a2 87 94 d5 G.I&n.N.h.mM.... 0110 c6 e9 66 e2 6c 84 44 2e 46 b1 1f c1 b8 41 01 51 ..f.l.D.F....A.Q 0120 41 53 5b 86 68 5c 58 43 26 bf 08 73 4d 38 c2 4f AS[.h\XC&..sM8.O 0130 22 44 d0 f8 7b 15 64 d9 94 8c e5 f7 20 10 4d dc "D..{.d..... .M. 0140 d5 99 61 4c 5f f9 09 ed 97 f1 71 87 5f 16 d7 02 ..aL_.....q._... 0150 e1 df .. Frame 9 (98 bytes on wire, 98 bytes captured) Arrival Time: Jan 21, 2006 16:02:12.054917000 Time delta from previous packet: 0.009300000 seconds Time since reference or first frame: 0.044675000 seconds Frame Number: 9 Packet Length: 98 bytes Capture Length: 98 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:0c:29:f4:af:90 (00:0c:29:f4:af:90), Dst: 00:13:c4:80:d3:aa (00:13:c4:80:d3:aa) Destination: 00:13:c4:80:d3:aa (00:13:c4:80:d3:aa) Source: 00:0c:29:f4:af:90 (00:0c:29:f4:af:90) Type: IP (0x0800) Trailer: D6156178 Internet Protocol, Src: 165.227.249.124 (165.227.249.124), Dst: 165.227.249.147 (165.227.249.147) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 80 Identification: 0x00c0 (192) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0x3b06 [correct] Good: True Bad : False Source: 165.227.249.124 (165.227.249.124) Destination: 165.227.249.147 (165.227.249.147) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 60 Checksum: 0x8458 [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0xD194C105E77B1CAF Responder cookie: 0x0458B5454CB75458 Next payload: Hash (8) Version: 1.0 Exchange type: Quick Mode (32) Flags .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x748A2F63 Length: 52 Encrypted payload (24 bytes) 0000 00 13 c4 80 d3 aa 00 0c 29 f4 af 90 08 00 45 00 ........).....E. 0010 00 50 00 c0 00 00 40 11 3b 06 a5 e3 f9 7c a5 e3 .P....@.;....|.. 0020 f9 93 01 f4 01 f4 00 3c 84 58 d1 94 c1 05 e7 7b .......<.X.....{ 0030 1c af 04 58 b5 45 4c b7 54 58 08 10 20 01 74 8a ...X.EL.TX.. .t. 0040 2f 63 00 00 00 34 44 64 8f 24 b7 6d 59 95 0f 1e /c...4Dd.$.mY... 0050 ca 68 a0 3e b4 ff ee e3 a7 f5 17 b0 b8 dd d6 15 .h.>............ 0060 61 78 ax Frame 10 (154 bytes on wire, 154 bytes captured) Arrival Time: Jan 21, 2006 16:02:12.354796000 Time delta from previous packet: 0.299879000 seconds Time since reference or first frame: 0.344554000 seconds Frame Number: 10 Packet Length: 154 bytes Capture Length: 154 bytes Protocols in frame: eth:ip:esp:data Ethernet II, Src: 00:0c:29:f4:af:90 (00:0c:29:f4:af:90), Dst: 00:13:c4:80:d3:aa (00:13:c4:80:d3:aa) Destination: 00:13:c4:80:d3:aa (00:13:c4:80:d3:aa) Source: 00:0c:29:f4:af:90 (00:0c:29:f4:af:90) Type: IP (0x0800) Trailer: CD209AA9 Internet Protocol, Src: 165.227.249.124 (165.227.249.124), Dst: 165.227.249.147 (165.227.249.147) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 136 Identification: 0x0000 (0) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 240 Protocol: ESP (0x32) Header checksum: 0x8b6c [correct] Good: True Bad : False Source: 165.227.249.124 (165.227.249.124) Destination: 165.227.249.147 (165.227.249.147) Encapsulating Security Payload SPI: 0x2c6d18cb Sequence: 2 Data (108 bytes) 0000 00 13 c4 80 d3 aa 00 0c 29 f4 af 90 08 00 45 00 ........).....E. 0010 00 88 00 00 00 00 f0 32 8b 6c a5 e3 f9 7c a5 e3 .......2.l...|.. 0020 f9 93 2c 6d 18 cb 00 00 00 02 a2 98 f3 67 32 b3 ..,m.........g2. 0030 06 27 e6 1e 3a 67 da 48 e9 f6 4d 59 5f d1 8c 77 .'..:g.H..MY_..w 0040 3a 9e 40 cc 59 41 ad 82 65 c9 2c 2d e9 72 6b c0 :.@.YA..e.,-.rk. 0050 68 00 31 df 3b 74 1c 6c 80 f3 6b 2a 2d 0f a2 34 h.1.;t.l..k*-..4 0060 5b e9 70 28 71 c7 e7 f3 46 bb 05 87 d5 e6 23 7b [.p(q...F.....#{ 0070 78 f3 ae bb 4b ab 65 df 0e a8 25 0e 5b 30 b5 2d x...K.e...%.[0.- 0080 93 c1 d6 a6 99 d0 8c e1 1d 01 05 a1 ce 3e 9f 80 .............>.. 0090 29 55 dc dd 31 20 cd 20 9a a9 )U..1 . .. Frame 11 (154 bytes on wire, 154 bytes captured) Arrival Time: Jan 21, 2006 16:02:12.355530000 Time delta from previous packet: 0.000734000 seconds Time since reference or first frame: 0.345288000 seconds Frame Number: 11 Packet Length: 154 bytes Capture Length: 154 bytes Protocols in frame: eth:ip:esp:data Ethernet II, Src: 00:13:c4:80:d3:aa (00:13:c4:80:d3:aa), Dst: 00:0c:29:f4:af:90 (00:0c:29:f4:af:90) Destination: 00:0c:29:f4:af:90 (00:0c:29:f4:af:90) Source: 00:13:c4:80:d3:aa (00:13:c4:80:d3:aa) Type: IP (0x0800) Trailer: 1C2300AD Internet Protocol, Src: 165.227.249.147 (165.227.249.147), Dst: 165.227.249.124 (165.227.249.124) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 136 Identification: 0x802d (32813) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: ESP (0x32) Header checksum: 0xbb3f [correct] Good: True Bad : False Source: 165.227.249.147 (165.227.249.147) Destination: 165.227.249.124 (165.227.249.124) Encapsulating Security Payload SPI: 0x1aba4b3b Sequence: 1 Data (108 bytes) 0000 00 0c 29 f4 af 90 00 13 c4 80 d3 aa 08 00 45 00 ..)...........E. 0010 00 88 80 2d 00 00 40 32 bb 3f a5 e3 f9 93 a5 e3 ...-..@2.?...... 0020 f9 7c 1a ba 4b 3b 00 00 00 01 b5 b9 3f d6 0a 03 .|..K;......?... 0030 f7 71 48 be e0 ff c3 5c d4 17 d7 28 bd f5 46 e0 .qH....\...(..F. 0040 d1 05 ff f7 30 23 d7 76 28 de a2 10 8f cc d7 75 ....0#.v(......u 0050 52 0c 4a 47 fc 96 4f 86 d7 20 63 75 71 8f b1 b4 R.JG..O.. cuq... 0060 50 11 fd db 38 c1 59 23 dd e7 c6 97 07 ca c4 f9 P...8.Y#........ 0070 cf 02 0d 4d 0e ba 35 8c d6 b7 ac 88 d6 6b f9 33 ...M..5......k.3 0080 e5 da 93 56 c3 3d ad b2 7b 5e 1d 20 74 9a 1a bf ...V.=..{^. t... 0090 d9 0d 3b 31 ce 72 1c 23 00 ad ..;1.r.#.. Frame 12 (154 bytes on wire, 154 bytes captured) Arrival Time: Jan 21, 2006 16:02:12.978691000 Time delta from previous packet: 0.623161000 seconds Time since reference or first frame: 0.968449000 seconds Frame Number: 12 Packet Length: 154 bytes Capture Length: 154 bytes Protocols in frame: eth:ip:esp:data Ethernet II, Src: 00:0c:29:f4:af:90 (00:0c:29:f4:af:90), Dst: 00:13:c4:80:d3:aa (00:13:c4:80:d3:aa) Destination: 00:13:c4:80:d3:aa (00:13:c4:80:d3:aa) Source: 00:0c:29:f4:af:90 (00:0c:29:f4:af:90) Type: IP (0x0800) Trailer: C7088A5A Internet Protocol, Src: 165.227.249.124 (165.227.249.124), Dst: 165.227.249.147 (165.227.249.147) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 136 Identification: 0x0001 (1) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 240 Protocol: ESP (0x32) Header checksum: 0x8b6b [correct] Good: True Bad : False Source: 165.227.249.124 (165.227.249.124) Destination: 165.227.249.147 (165.227.249.147) Encapsulating Security Payload SPI: 0x2c6d18cb Sequence: 3 Data (108 bytes) 0000 00 13 c4 80 d3 aa 00 0c 29 f4 af 90 08 00 45 00 ........).....E. 0010 00 88 00 01 00 00 f0 32 8b 6b a5 e3 f9 7c a5 e3 .......2.k...|.. 0020 f9 93 2c 6d 18 cb 00 00 00 03 0a d9 d4 96 d4 e4 ..,m............ 0030 ba 5b af 94 f6 f8 26 74 55 9c ed 55 e7 59 fe 80 .[....&tU..U.Y.. 0040 ff 63 63 ad 99 47 59 04 72 fd b5 f6 b7 58 50 67 .cc..GY.r....XPg 0050 54 2a f3 84 32 94 b4 5e 46 40 62 49 7d 62 31 88 T*..2..^F@bI}b1. 0060 8a 7c b5 c3 0f dc a7 5a 9e e3 01 5f 43 5b 5f 30 .|.....Z..._C[_0 0070 d4 4d 7f aa 8a 25 78 4f 88 f6 f2 5f ec 5e 0e 2d .M...%xO..._.^.- 0080 22 3a 1c b6 cf 8c cf 0c 5e 63 51 79 24 62 83 0a ":......^cQy$b.. 0090 00 5d af 83 e8 28 c7 08 8a 5a .]...(...Z Frame 13 (154 bytes on wire, 154 bytes captured) Arrival Time: Jan 21, 2006 16:02:12.979093000 Time delta from previous packet: 0.000402000 seconds Time since reference or first frame: 0.968851000 seconds Frame Number: 13 Packet Length: 154 bytes Capture Length: 154 bytes Protocols in frame: eth:ip:esp:data Ethernet II, Src: 00:13:c4:80:d3:aa (00:13:c4:80:d3:aa), Dst: 00:0c:29:f4:af:90 (00:0c:29:f4:af:90) Destination: 00:0c:29:f4:af:90 (00:0c:29:f4:af:90) Source: 00:13:c4:80:d3:aa (00:13:c4:80:d3:aa) Type: IP (0x0800) Trailer: D0BB9537 Internet Protocol, Src: 165.227.249.147 (165.227.249.147), Dst: 165.227.249.124 (165.227.249.124) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 136 Identification: 0x822d (33325) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: ESP (0x32) Header checksum: 0xb93f [correct] Good: True Bad : False Source: 165.227.249.147 (165.227.249.147) Destination: 165.227.249.124 (165.227.249.124) Encapsulating Security Payload SPI: 0x1aba4b3b Sequence: 2 Data (108 bytes) 0000 00 0c 29 f4 af 90 00 13 c4 80 d3 aa 08 00 45 00 ..)...........E. 0010 00 88 82 2d 00 00 40 32 b9 3f a5 e3 f9 93 a5 e3 ...-..@2.?...... 0020 f9 7c 1a ba 4b 3b 00 00 00 02 26 52 82 2a 95 42 .|..K;....&R.*.B 0030 80 16 b6 39 31 41 3c ea 91 9c b5 ca 4a 35 41 d6 ...91A<.....J5A. 0040 c7 22 90 b6 82 9a 92 ec ed c3 17 fe f6 de c6 1f .".............. 0050 58 0f 6a 87 4d 6f 86 b9 f7 26 95 bd 2e c6 36 62 X.j.Mo...&....6b 0060 a0 4b 45 bd 8e d9 a1 58 34 10 c9 ea 8e eb ff 32 .KE....X4......2 0070 89 fe 3a 21 a2 c1 f9 ce ba 2b 6d 37 76 37 72 91 ..:!.....+m7v7r. 0080 e2 37 f5 e4 22 83 c0 a4 2a 04 6a 68 37 fc 3b d4 .7.."...*.jh7.;. 0090 24 03 0a 9c 00 27 d0 bb 95 37 $....'...7 Frame 14 (154 bytes on wire, 154 bytes captured) Arrival Time: Jan 21, 2006 16:02:14.007694000 Time delta from previous packet: 1.028601000 seconds Time since reference or first frame: 1.997452000 seconds Frame Number: 14 Packet Length: 154 bytes Capture Length: 154 bytes Protocols in frame: eth:ip:esp:data Ethernet II, Src: 00:0c:29:f4:af:90 (00:0c:29:f4:af:90), Dst: 00:13:c4:80:d3:aa (00:13:c4:80:d3:aa) Destination: 00:13:c4:80:d3:aa (00:13:c4:80:d3:aa) Source: 00:0c:29:f4:af:90 (00:0c:29:f4:af:90) Type: IP (0x0800) Trailer: D7360473 Internet Protocol, Src: 165.227.249.124 (165.227.249.124), Dst: 165.227.249.147 (165.227.249.147) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 136 Identification: 0x0002 (2) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 240 Protocol: ESP (0x32) Header checksum: 0x8b6a [correct] Good: True Bad : False Source: 165.227.249.124 (165.227.249.124) Destination: 165.227.249.147 (165.227.249.147) Encapsulating Security Payload SPI: 0x2c6d18cb Sequence: 4 Data (108 bytes) 0000 00 13 c4 80 d3 aa 00 0c 29 f4 af 90 08 00 45 00 ........).....E. 0010 00 88 00 02 00 00 f0 32 8b 6a a5 e3 f9 7c a5 e3 .......2.j...|.. 0020 f9 93 2c 6d 18 cb 00 00 00 04 4c 65 52 c4 c1 e5 ..,m......LeR... 0030 df 1f 9f 9b 35 26 f4 9d 91 2d e6 2b d5 81 89 cc ....5&...-.+.... 0040 88 80 53 32 f3 30 e8 35 66 e4 49 ff be e7 64 6d ..S2.0.5f.I...dm 0050 b8 ce d9 62 05 0d f4 0b d1 56 31 2d 24 f7 3c 87 ...b.....V1-$.<. 0060 1d b6 3d 7a c1 a6 95 4a d2 e0 8f f6 15 2c 00 17 ..=z...J.....,.. 0070 f1 14 68 1f 23 29 f2 6a 9e 35 31 12 53 53 a2 71 ..h.#).j.51.SS.q 0080 00 eb ff be f6 e4 57 5e 2a bd 03 d9 68 e1 c2 c0 ......W^*...h... 0090 aa a4 ae 46 1e 00 d7 36 04 73 ...F...6.s Frame 15 (154 bytes on wire, 154 bytes captured) Arrival Time: Jan 21, 2006 16:02:14.008078000 Time delta from previous packet: 0.000384000 seconds Time since reference or first frame: 1.997836000 seconds Frame Number: 15 Packet Length: 154 bytes Capture Length: 154 bytes Protocols in frame: eth:ip:esp:data Ethernet II, Src: 00:13:c4:80:d3:aa (00:13:c4:80:d3:aa), Dst: 00:0c:29:f4:af:90 (00:0c:29:f4:af:90) Destination: 00:0c:29:f4:af:90 (00:0c:29:f4:af:90) Source: 00:13:c4:80:d3:aa (00:13:c4:80:d3:aa) Type: IP (0x0800) Trailer: 87EE3FB6 Internet Protocol, Src: 165.227.249.147 (165.227.249.147), Dst: 165.227.249.124 (165.227.249.124) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 136 Identification: 0x832d (33581) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: ESP (0x32) Header checksum: 0xb83f [correct] Good: True Bad : False Source: 165.227.249.147 (165.227.249.147) Destination: 165.227.249.124 (165.227.249.124) Encapsulating Security Payload SPI: 0x1aba4b3b Sequence: 3 Data (108 bytes) 0000 00 0c 29 f4 af 90 00 13 c4 80 d3 aa 08 00 45 00 ..)...........E. 0010 00 88 83 2d 00 00 40 32 b8 3f a5 e3 f9 93 a5 e3 ...-..@2.?...... 0020 f9 7c 1a ba 4b 3b 00 00 00 03 2d 94 6e cf 39 a1 .|..K;....-.n.9. 0030 f7 af 7a 5b 64 a8 38 18 ca 12 27 f0 be 8c 1d bc ..z[d.8...'..... 0040 b0 6f af 00 da 1e 9d ed 03 26 27 ad df a7 26 72 .o.......&'...&r 0050 fa 52 dc 08 c2 72 6c 99 c3 12 80 bb 25 75 b2 76 .R...rl.....%u.v 0060 ec f3 15 87 b0 c9 28 cd 1e 9b e8 a1 7e 86 fa 1f ......(.....~... 0070 72 af 11 02 b0 ba 4f 99 99 b2 7d 10 fb ce cb d9 r.....O...}..... 0080 8a d2 76 27 5b f6 a3 c1 23 1e ff eb fc 92 21 2b ..v'[...#.....!+ 0090 70 41 38 72 20 d9 87 ee 3f b6 pA8r ...?. Frame 16 (154 bytes on wire, 154 bytes captured) Arrival Time: Jan 21, 2006 16:02:15.013541000 Time delta from previous packet: 1.005463000 seconds Time since reference or first frame: 3.003299000 seconds Frame Number: 16 Packet Length: 154 bytes Capture Length: 154 bytes Protocols in frame: eth:ip:esp:data Ethernet II, Src: 00:0c:29:f4:af:90 (00:0c:29:f4:af:90), Dst: 00:13:c4:80:d3:aa (00:13:c4:80:d3:aa) Destination: 00:13:c4:80:d3:aa (00:13:c4:80:d3:aa) Source: 00:0c:29:f4:af:90 (00:0c:29:f4:af:90) Type: IP (0x0800) Trailer: 39B7AFBD Internet Protocol, Src: 165.227.249.124 (165.227.249.124), Dst: 165.227.249.147 (165.227.249.147) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 136 Identification: 0x0003 (3) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 240 Protocol: ESP (0x32) Header checksum: 0x8b69 [correct] Good: True Bad : False Source: 165.227.249.124 (165.227.249.124) Destination: 165.227.249.147 (165.227.249.147) Encapsulating Security Payload SPI: 0x2c6d18cb Sequence: 5 Data (108 bytes) 0000 00 13 c4 80 d3 aa 00 0c 29 f4 af 90 08 00 45 00 ........).....E. 0010 00 88 00 03 00 00 f0 32 8b 69 a5 e3 f9 7c a5 e3 .......2.i...|.. 0020 f9 93 2c 6d 18 cb 00 00 00 05 d1 7a 02 53 f0 84 ..,m.......z.S.. 0030 bd c6 b1 d9 79 7b d1 9c cf b9 29 29 ee f0 af 01 ....y{....)).... 0040 8c 34 3f d2 3d 94 f6 b0 49 78 5d af d6 8e c8 d1 .4?.=...Ix]..... 0050 71 00 5a 21 fc 10 35 59 25 ee ca be e9 02 ee bd q.Z!..5Y%....... 0060 46 96 86 1b 14 b2 67 49 21 dd b6 4e ca c6 47 61 F.....gI!..N..Ga 0070 c7 50 c7 ff fb 7d e4 81 16 fd 42 c2 a5 52 f2 15 .P...}....B..R.. 0080 67 51 cc 05 f3 c4 d4 3d f3 94 1c 59 aa b5 d7 bd gQ.....=...Y.... 0090 ba 51 12 75 ae 56 39 b7 af bd .Q.u.V9... Frame 17 (154 bytes on wire, 154 bytes captured) Arrival Time: Jan 21, 2006 16:02:15.013894000 Time delta from previous packet: 0.000353000 seconds Time since reference or first frame: 3.003652000 seconds Frame Number: 17 Packet Length: 154 bytes Capture Length: 154 bytes Protocols in frame: eth:ip:esp:data Ethernet II, Src: 00:13:c4:80:d3:aa (00:13:c4:80:d3:aa), Dst: 00:0c:29:f4:af:90 (00:0c:29:f4:af:90) Destination: 00:0c:29:f4:af:90 (00:0c:29:f4:af:90) Source: 00:13:c4:80:d3:aa (00:13:c4:80:d3:aa) Type: IP (0x0800) Trailer: 79BF3FD7 Internet Protocol, Src: 165.227.249.147 (165.227.249.147), Dst: 165.227.249.124 (165.227.249.124) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 136 Identification: 0x842d (33837) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: ESP (0x32) Header checksum: 0xb73f [correct] Good: True Bad : False Source: 165.227.249.147 (165.227.249.147) Destination: 165.227.249.124 (165.227.249.124) Encapsulating Security Payload SPI: 0x1aba4b3b Sequence: 4 Data (108 bytes) 0000 00 0c 29 f4 af 90 00 13 c4 80 d3 aa 08 00 45 00 ..)...........E. 0010 00 88 84 2d 00 00 40 32 b7 3f a5 e3 f9 93 a5 e3 ...-..@2.?...... 0020 f9 7c 1a ba 4b 3b 00 00 00 04 a8 d2 17 53 c5 b7 .|..K;.......S.. 0030 e3 86 d9 d9 55 a5 25 a6 1d 2c 7e 6c 67 33 d4 bb ....U.%..,~lg3.. 0040 c3 3a 8b c1 07 10 ad 3a 5e 52 46 d5 f4 92 9f 17 .:.....:^RF..... 0050 d5 54 77 b2 96 c6 4b 6f df d5 78 8a 42 70 37 17 .Tw...Ko..x.Bp7. 0060 26 5c 0c 97 35 6d aa aa a3 fc 0e 71 ef 79 ff 1f &\..5m.....q.y.. 0070 06 e5 1f 6e c8 cc 95 a7 86 90 0e 5d b0 98 2f 21 ...n.......]../! 0080 70 97 55 2d c8 89 45 bc 96 14 21 91 36 14 8d 13 p.U-..E...!.6... 0090 47 91 92 28 08 0d 79 bf 3f d7 G..(..y.?.