Frame 1 (118 bytes on wire, 118 bytes captured) Arrival Time: Jan 25, 2008 11:09:30.859498000 Time delta from previous packet: 0.000000000 seconds Time since reference or first frame: 0.000000000 seconds Frame Number: 1 Packet Length: 118 bytes Capture Length: 118 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:0c:29:f4:af:90 (00:0c:29:f4:af:90), Dst: 00:90:7f:3e:ca:91 (00:90:7f:3e:ca:91) Destination: 00:90:7f:3e:ca:91 (00:90:7f:3e:ca:91) Source: 00:0c:29:f4:af:90 (00:0c:29:f4:af:90) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.124 (165.227.249.124), Dst: 165.227.249.152 (165.227.249.152) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 104 Identification: 0x014e (334) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0x3a5b [correct] Good: True Bad : False Source: 165.227.249.124 (165.227.249.124) Destination: 165.227.249.152 (165.227.249.152) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 84 Checksum: 0x1528 [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0xD86D3AB0563A5CB3 Responder cookie: 0x9E3D1AF11C443B45 Next payload: Hash (8) Version: 1.0 Exchange type: Informational (5) Flags .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x4C365CB3 Length: 76 Encrypted payload (48 bytes) 0000 00 90 7f 3e ca 91 00 0c 29 f4 af 90 08 00 45 00 ...>....).....E. 0010 00 68 01 4e 00 00 40 11 3a 5b a5 e3 f9 7c a5 e3 .h.N..@.:[...|.. 0020 f9 98 01 f4 01 f4 00 54 15 28 d8 6d 3a b0 56 3a .......T.(.m:.V: 0030 5c b3 9e 3d 1a f1 1c 44 3b 45 08 10 05 01 4c 36 \..=...D;E....L6 0040 5c b3 00 00 00 4c e2 c4 26 45 c5 83 d2 1e 03 99 \....L..&E...... 0050 9f 38 c3 53 ac 4c 74 bd f9 b6 e3 ae 5d e5 1f b0 .8.S.Lt.....]... 0060 18 54 42 66 50 23 31 36 b6 78 65 52 d6 dd 19 7a .TBfP#16.xeR...z 0070 23 ac 0a ac 80 e8 #..... Frame 2 (134 bytes on wire, 134 bytes captured) Arrival Time: Jan 25, 2008 11:09:30.859500000 Time delta from previous packet: 0.000002000 seconds Time since reference or first frame: 0.000002000 seconds Frame Number: 2 Packet Length: 134 bytes Capture Length: 134 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:0c:29:f4:af:90 (00:0c:29:f4:af:90), Dst: 00:90:7f:3e:ca:91 (00:90:7f:3e:ca:91) Destination: 00:90:7f:3e:ca:91 (00:90:7f:3e:ca:91) Source: 00:0c:29:f4:af:90 (00:0c:29:f4:af:90) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.124 (165.227.249.124), Dst: 165.227.249.152 (165.227.249.152) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 120 Identification: 0x014f (335) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0x3a4a [correct] Good: True Bad : False Source: 165.227.249.124 (165.227.249.124) Destination: 165.227.249.152 (165.227.249.152) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 100 Checksum: 0xb228 [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0xD86D3AB0563A5CB3 Responder cookie: 0x9E3D1AF11C443B45 Next payload: Hash (8) Version: 1.0 Exchange type: Informational (5) Flags .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x958D3C56 Length: 92 Encrypted payload (64 bytes) 0000 00 90 7f 3e ca 91 00 0c 29 f4 af 90 08 00 45 00 ...>....).....E. 0010 00 78 01 4f 00 00 40 11 3a 4a a5 e3 f9 7c a5 e3 .x.O..@.:J...|.. 0020 f9 98 01 f4 01 f4 00 64 b2 28 d8 6d 3a b0 56 3a .......d.(.m:.V: 0030 5c b3 9e 3d 1a f1 1c 44 3b 45 08 10 05 01 95 8d \..=...D;E...... 0040 3c 56 00 00 00 5c 35 aa 63 01 40 27 0d f4 54 fc s.c...m...' 0080 4f e2 49 ef f6 76 O.I..v Frame 3 (266 bytes on wire, 266 bytes captured) Arrival Time: Jan 25, 2008 11:09:48.288334000 Time delta from previous packet: 17.428834000 seconds Time since reference or first frame: 17.428836000 seconds Frame Number: 3 Packet Length: 266 bytes Capture Length: 266 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:0c:29:f4:af:90 (00:0c:29:f4:af:90), Dst: 00:90:7f:3e:ca:91 (00:90:7f:3e:ca:91) Destination: 00:90:7f:3e:ca:91 (00:90:7f:3e:ca:91) Source: 00:0c:29:f4:af:90 (00:0c:29:f4:af:90) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.124 (165.227.249.124), Dst: 165.227.249.152 (165.227.249.152) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 252 Identification: 0x0150 (336) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0x39c5 [correct] Good: True Bad : False Source: 165.227.249.124 (165.227.249.124) Destination: 165.227.249.152 (165.227.249.152) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 232 Checksum: 0x1229 [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0xC3BA98259A2BC110 Responder cookie: 0x0000000000000000 Next payload: Security Association (1) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 224 Security Association payload Next payload: Vendor ID (13) Length: 56 Domain of interpretation: IPSEC (1) Situation: IDENTITY (1) Proposal payload # 0 Next payload: NONE (0) Length: 44 Proposal number: 0 Protocol ID: ISAKMP (1) SPI size: 0 Number of transforms: 1 Transform payload # 0 Next payload: NONE (0) Length: 36 Transform number: 0 Transform ID: KEY_IKE (1) Encryption-Algorithm (1): AES-CBC (7) Key-Length (14): Key-Length (128) Hash-Algorithm (2): SHA (2) Authentication-Method (3): PSK (1) Group-Description (4): Alternate 1024-bit MODP group (2) Life-Type (11): Seconds (1) Life-Duration (12): Duration-Value (28800) Vendor ID payload Next payload: Vendor ID (13) Length: 20 Vendor ID: unknown vendor ID: 0x8F9CC94E01248ECDF147594C284B213B Vendor ID payload Next payload: Vendor ID (13) Length: 20 Vendor ID: draft-stenberg-ipsec-nat-traversal-01 Vendor ID payload Next payload: Vendor ID (13) Length: 20 Vendor ID: draft-stenberg-ipsec-nat-traversal-02 Vendor ID payload Next payload: Vendor ID (13) Length: 20 Vendor ID: draft-ietf-ipsec-nat-t-ike-00 Vendor ID payload Next payload: Vendor ID (13) Length: 20 Vendor ID: draft-ietf-ipsec-nat-t-ike-02 Vendor ID payload Next payload: Vendor ID (13) Length: 20 Vendor ID: draft-ietf-ipsec-nat-t-ike-02 Vendor ID payload Next payload: NONE (0) Length: 20 Vendor ID: draft-ietf-ipsec-nat-t-ike-03 0000 00 90 7f 3e ca 91 00 0c 29 f4 af 90 08 00 45 00 ...>....).....E. 0010 00 fc 01 50 00 00 40 11 39 c5 a5 e3 f9 7c a5 e3 ...P..@.9....|.. 0020 f9 98 01 f4 01 f4 00 e8 12 29 c3 ba 98 25 9a 2b .........)...%.+ 0030 c1 10 00 00 00 00 00 00 00 00 01 10 02 00 00 00 ................ 0040 00 00 00 00 00 e0 0d 00 00 38 00 00 00 01 00 00 .........8...... 0050 00 01 00 00 00 2c 00 01 00 01 00 00 00 24 00 01 .....,.......$.. 0060 00 00 80 01 00 07 80 0e 00 80 80 02 00 02 80 03 ................ 0070 00 01 80 04 00 02 80 0b 00 01 80 0c 70 80 0d 00 ............p... 0080 00 14 8f 9c c9 4e 01 24 8e cd f1 47 59 4c 28 4b .....N.$...GYL(K 0090 21 3b 0d 00 00 14 27 ba b5 dc 01 ea 07 60 ea 4e !;....'......`.N 00a0 31 90 ac 27 c0 d0 0d 00 00 14 61 05 c4 22 e7 68 1..'......a..".h 00b0 47 e4 3f 96 84 80 12 92 ae cd 0d 00 00 14 44 85 G.?...........D. 00c0 15 2d 18 b6 bb cd 0b e8 a8 46 95 79 dd cc 0d 00 .-.......F.y.... 00d0 00 14 cd 60 46 43 35 df 21 f8 7c fd b2 fc 68 b6 ...`FC5.!.|...h. 00e0 a4 48 0d 00 00 14 90 cb 80 91 3e bb 69 6e 08 63 .H........>.in.c 00f0 81 b5 ec 42 7b 1f 00 00 00 14 7d 94 19 a6 53 10 ...B{.....}...S. 0100 ca 6f 2c 17 9d 92 15 52 9d 56 .o,....R.V Frame 4 (138 bytes on wire, 138 bytes captured) Arrival Time: Jan 25, 2008 11:09:48.293356000 Time delta from previous packet: 0.005022000 seconds Time since reference or first frame: 17.433858000 seconds Frame Number: 4 Packet Length: 138 bytes Capture Length: 138 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:90:7f:3e:ca:91 (00:90:7f:3e:ca:91), Dst: 00:0c:29:f4:af:90 (00:0c:29:f4:af:90) Destination: 00:0c:29:f4:af:90 (00:0c:29:f4:af:90) Source: 00:90:7f:3e:ca:91 (00:90:7f:3e:ca:91) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.152 (165.227.249.152), Dst: 165.227.249.124 (165.227.249.124) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 124 Identification: 0xa746 (42822) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0x944e [correct] Good: True Bad : False Source: 165.227.249.152 (165.227.249.152) Destination: 165.227.249.124 (165.227.249.124) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 104 Checksum: 0x8b9c [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0xC3BA98259A2BC110 Responder cookie: 0xB64E6AB079721673 Next payload: Security Association (1) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 96 Security Association payload Next payload: Vendor ID (13) Length: 56 Domain of interpretation: IPSEC (1) Situation: IDENTITY (1) Proposal payload # 0 Next payload: NONE (0) Length: 44 Proposal number: 0 Protocol ID: ISAKMP (1) SPI size: 0 Number of transforms: 1 Transform payload # 0 Next payload: NONE (0) Length: 36 Transform number: 0 Transform ID: KEY_IKE (1) Encryption-Algorithm (1): AES-CBC (7) Key-Length (14): Key-Length (128) Hash-Algorithm (2): SHA (2) Authentication-Method (3): PSK (1) Group-Description (4): Alternate 1024-bit MODP group (2) Life-Type (11): Seconds (1) Life-Duration (12): Duration-Value (28800) Vendor ID payload Next payload: NONE (0) Length: 12 Vendor ID: draft-beaulieu-ike-xauth-02.txt 0000 00 0c 29 f4 af 90 00 90 7f 3e ca 91 08 00 45 00 ..)......>....E. 0010 00 7c a7 46 00 00 40 11 94 4e a5 e3 f9 98 a5 e3 .|.F..@..N...... 0020 f9 7c 01 f4 01 f4 00 68 8b 9c c3 ba 98 25 9a 2b .|.....h.....%.+ 0030 c1 10 b6 4e 6a b0 79 72 16 73 01 10 02 00 00 00 ...Nj.yr.s...... 0040 00 00 00 00 00 60 0d 00 00 38 00 00 00 01 00 00 .....`...8...... 0050 00 01 00 00 00 2c 00 01 00 01 00 00 00 24 00 01 .....,.......$.. 0060 00 00 80 01 00 07 80 0e 00 80 80 02 00 02 80 03 ................ 0070 00 01 80 04 00 02 80 0b 00 01 80 0c 70 80 00 00 ............p... 0080 00 0c 09 00 26 89 df d6 b7 12 ....&..... Frame 5 (222 bytes on wire, 222 bytes captured) Arrival Time: Jan 25, 2008 11:09:48.293358000 Time delta from previous packet: 0.000002000 seconds Time since reference or first frame: 17.433860000 seconds Frame Number: 5 Packet Length: 222 bytes Capture Length: 222 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:0c:29:f4:af:90 (00:0c:29:f4:af:90), Dst: 00:90:7f:3e:ca:91 (00:90:7f:3e:ca:91) Destination: 00:90:7f:3e:ca:91 (00:90:7f:3e:ca:91) Source: 00:0c:29:f4:af:90 (00:0c:29:f4:af:90) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.124 (165.227.249.124), Dst: 165.227.249.152 (165.227.249.152) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 208 Identification: 0x0151 (337) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0x39f0 [correct] Good: True Bad : False Source: 165.227.249.124 (165.227.249.124) Destination: 165.227.249.152 (165.227.249.152) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 188 Checksum: 0x9989 [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0xC3BA98259A2BC110 Responder cookie: 0xB64E6AB079721673 Next payload: Key Exchange (4) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 180 Key Exchange payload Next payload: Nonce (10) Length: 132 Key Exchange Data Nonce payload Next payload: NONE (0) Length: 20 Nonce Data 0000 00 90 7f 3e ca 91 00 0c 29 f4 af 90 08 00 45 00 ...>....).....E. 0010 00 d0 01 51 00 00 40 11 39 f0 a5 e3 f9 7c a5 e3 ...Q..@.9....|.. 0020 f9 98 01 f4 01 f4 00 bc 99 89 c3 ba 98 25 9a 2b .............%.+ 0030 c1 10 b6 4e 6a b0 79 72 16 73 04 10 02 00 00 00 ...Nj.yr.s...... 0040 00 00 00 00 00 b4 0a 00 00 84 4e 5a 11 bb 0a 0c ..........NZ.... 0050 1c 61 61 e9 5d 17 69 0e 51 2a a2 3c cf 03 29 80 .aa.].i.Q*.<..). 0060 91 af 4a f4 42 c6 4e 9a 6c a0 93 2e b1 cb 2e 52 ..J.B.N.l......R 0070 2c c6 2b 04 a6 49 aa 34 41 43 50 c1 d1 11 c3 f9 ,.+..I.4ACP..... 0080 f4 33 5c 54 c7 6b f8 4f 58 94 18 1f fa 70 43 45 .3\T.k.OX....pCE 0090 27 14 30 ac db f3 69 0e 54 b6 27 29 0e d1 24 16 '.0...i.T.')..$. 00a0 a9 1a 45 12 11 c8 67 88 c8 de 28 c2 2b 9c eb 06 ..E...g...(.+... 00b0 8d 45 1d ce 0c 35 93 5a 75 70 27 ba 2d cc ff 29 .E...5.Zup'.-..) 00c0 a6 90 32 9c d7 cd ae 1d 6b 5f 00 00 00 14 10 80 ..2.....k_...... 00d0 3b 47 a4 45 a8 b1 b1 1e 70 97 ce ed 0e 6d ;G.E....p....m Frame 6 (214 bytes on wire, 214 bytes captured) Arrival Time: Jan 25, 2008 11:09:48.320288000 Time delta from previous packet: 0.026930000 seconds Time since reference or first frame: 17.460790000 seconds Frame Number: 6 Packet Length: 214 bytes Capture Length: 214 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:90:7f:3e:ca:91 (00:90:7f:3e:ca:91), Dst: 00:0c:29:f4:af:90 (00:0c:29:f4:af:90) Destination: 00:0c:29:f4:af:90 (00:0c:29:f4:af:90) Source: 00:90:7f:3e:ca:91 (00:90:7f:3e:ca:91) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.152 (165.227.249.152), Dst: 165.227.249.124 (165.227.249.124) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 200 Identification: 0xa747 (42823) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0x9401 [correct] Good: True Bad : False Source: 165.227.249.152 (165.227.249.152) Destination: 165.227.249.124 (165.227.249.124) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 180 Checksum: 0xeccd [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0xC3BA98259A2BC110 Responder cookie: 0xB64E6AB079721673 Next payload: Key Exchange (4) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 172 Key Exchange payload Next payload: Nonce (10) Length: 132 Key Exchange Data Nonce payload Next payload: NONE (0) Length: 12 Nonce Data 0000 00 0c 29 f4 af 90 00 90 7f 3e ca 91 08 00 45 00 ..)......>....E. 0010 00 c8 a7 47 00 00 40 11 94 01 a5 e3 f9 98 a5 e3 ...G..@......... 0020 f9 7c 01 f4 01 f4 00 b4 ec cd c3 ba 98 25 9a 2b .|...........%.+ 0030 c1 10 b6 4e 6a b0 79 72 16 73 04 10 02 00 00 00 ...Nj.yr.s...... 0040 00 00 00 00 00 ac 0a 00 00 84 28 ae 4f fa c1 75 ..........(.O..u 0050 b7 20 be 03 7e ff b5 86 c0 bb 56 20 a4 2a 49 2b . ..~.....V .*I+ 0060 89 f9 df ce da 84 88 11 b3 f3 e6 08 f8 10 1d 7b ...............{ 0070 ee bf 58 29 27 33 24 01 55 73 72 23 64 75 7a ac ..X)'3$.Usr#duz. 0080 cd cb dd d6 cb f5 e5 bb 4a aa 6a 91 ea a0 7f aa ........J.j..... 0090 98 ad a8 ce 7a 96 4b 31 53 5e 34 61 9d 1d 12 e5 ....z.K1S^4a.... 00a0 f4 67 06 c9 a8 d6 21 0b fd 40 b7 ff 6f 2e 82 8c .g....!..@..o... 00b0 a6 30 be 1b 8c d8 cb 93 36 04 e6 45 d3 8b 0d 64 .0......6..E...d 00c0 2a fd 58 d9 1e c4 53 2e 96 db 00 00 00 0c ef 2c *.X...S........, 00d0 a3 45 33 3d 84 b6 .E3=.. Frame 7 (118 bytes on wire, 118 bytes captured) Arrival Time: Jan 25, 2008 11:09:48.320290000 Time delta from previous packet: 0.000002000 seconds Time since reference or first frame: 17.460792000 seconds Frame Number: 7 Packet Length: 118 bytes Capture Length: 118 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:0c:29:f4:af:90 (00:0c:29:f4:af:90), Dst: 00:90:7f:3e:ca:91 (00:90:7f:3e:ca:91) Destination: 00:90:7f:3e:ca:91 (00:90:7f:3e:ca:91) Source: 00:0c:29:f4:af:90 (00:0c:29:f4:af:90) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.124 (165.227.249.124), Dst: 165.227.249.152 (165.227.249.152) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 104 Identification: 0x0152 (338) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0x3a57 [correct] Good: True Bad : False Source: 165.227.249.124 (165.227.249.124) Destination: 165.227.249.152 (165.227.249.152) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 84 Checksum: 0x294d [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0xC3BA98259A2BC110 Responder cookie: 0xB64E6AB079721673 Next payload: Identification (5) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 76 Encrypted payload (48 bytes) 0000 00 90 7f 3e ca 91 00 0c 29 f4 af 90 08 00 45 00 ...>....).....E. 0010 00 68 01 52 00 00 40 11 3a 57 a5 e3 f9 7c a5 e3 .h.R..@.:W...|.. 0020 f9 98 01 f4 01 f4 00 54 29 4d c3 ba 98 25 9a 2b .......T)M...%.+ 0030 c1 10 b6 4e 6a b0 79 72 16 73 05 10 02 01 00 00 ...Nj.yr.s...... 0040 00 00 00 00 00 4c 35 e0 bd c2 11 14 6a 47 e4 3b .....L5.....jG.; 0050 88 31 ee 8a 3a 55 ac 7c d0 1c 63 bf 89 c6 e2 30 .1..:U.|..c....0 0060 26 86 13 d7 cb 5d 5b 0e c8 35 f2 26 7b f2 0a 04 &....][..5.&{... 0070 61 94 b9 d8 16 b0 a..... Frame 8 (118 bytes on wire, 118 bytes captured) Arrival Time: Jan 25, 2008 11:09:48.347886000 Time delta from previous packet: 0.027596000 seconds Time since reference or first frame: 17.488388000 seconds Frame Number: 8 Packet Length: 118 bytes Capture Length: 118 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:90:7f:3e:ca:91 (00:90:7f:3e:ca:91), Dst: 00:0c:29:f4:af:90 (00:0c:29:f4:af:90) Destination: 00:0c:29:f4:af:90 (00:0c:29:f4:af:90) Source: 00:90:7f:3e:ca:91 (00:90:7f:3e:ca:91) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.152 (165.227.249.152), Dst: 165.227.249.124 (165.227.249.124) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 104 Identification: 0xa748 (42824) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0x9460 [correct] Good: True Bad : False Source: 165.227.249.152 (165.227.249.152) Destination: 165.227.249.124 (165.227.249.124) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 84 Checksum: 0xa0db [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0xC3BA98259A2BC110 Responder cookie: 0xB64E6AB079721673 Next payload: Identification (5) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 76 Encrypted payload (48 bytes) 0000 00 0c 29 f4 af 90 00 90 7f 3e ca 91 08 00 45 00 ..)......>....E. 0010 00 68 a7 48 00 00 40 11 94 60 a5 e3 f9 98 a5 e3 .h.H..@..`...... 0020 f9 7c 01 f4 01 f4 00 54 a0 db c3 ba 98 25 9a 2b .|.....T.....%.+ 0030 c1 10 b6 4e 6a b0 79 72 16 73 05 10 02 01 00 00 ...Nj.yr.s...... 0040 00 00 00 00 00 4c 1c a1 f6 46 32 a2 b5 ba 9d f4 .....L...F2..... 0050 77 d7 15 43 cc a8 a4 21 d4 9c 97 57 72 05 50 45 w..C...!...Wr.PE 0060 78 31 50 83 1e 44 48 96 e3 a2 59 21 f9 f6 79 56 x1P..DH...Y!..yV 0070 6f 4c 70 64 27 98 oLpd'. Frame 9 (342 bytes on wire, 342 bytes captured) Arrival Time: Jan 25, 2008 11:09:48.347888000 Time delta from previous packet: 0.000002000 seconds Time since reference or first frame: 17.488390000 seconds Frame Number: 9 Packet Length: 342 bytes Capture Length: 342 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:0c:29:f4:af:90 (00:0c:29:f4:af:90), Dst: 00:90:7f:3e:ca:91 (00:90:7f:3e:ca:91) Destination: 00:90:7f:3e:ca:91 (00:90:7f:3e:ca:91) Source: 00:0c:29:f4:af:90 (00:0c:29:f4:af:90) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.124 (165.227.249.124), Dst: 165.227.249.152 (165.227.249.152) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 328 Identification: 0x0153 (339) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0x3976 [correct] Good: True Bad : False Source: 165.227.249.124 (165.227.249.124) Destination: 165.227.249.152 (165.227.249.152) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 308 Checksum: 0x7b7e [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0xC3BA98259A2BC110 Responder cookie: 0xB64E6AB079721673 Next payload: Hash (8) Version: 1.0 Exchange type: Quick Mode (32) Flags .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x953A7292 Length: 300 Encrypted payload (272 bytes) 0000 00 90 7f 3e ca 91 00 0c 29 f4 af 90 08 00 45 00 ...>....).....E. 0010 01 48 01 53 00 00 40 11 39 76 a5 e3 f9 7c a5 e3 .H.S..@.9v...|.. 0020 f9 98 01 f4 01 f4 01 34 7b 7e c3 ba 98 25 9a 2b .......4{~...%.+ 0030 c1 10 b6 4e 6a b0 79 72 16 73 08 10 20 01 95 3a ...Nj.yr.s.. ..: 0040 72 92 00 00 01 2c b4 f7 a7 9b b6 e5 77 aa 3c 0e r....,......w.<. 0050 50 d2 21 4d a6 21 87 c7 64 0e b9 9c dd 32 d8 d7 P.!M.!..d....2.. 0060 34 2e c6 4b 83 c0 e2 2d bd 9b 49 bd b7 c8 67 f4 4..K...-..I...g. 0070 57 7a 93 28 a5 45 67 e2 0e b8 65 76 8b 56 d3 23 Wz.(.Eg...ev.V.# 0080 41 dc 53 0d 3c db 60 1e 65 03 34 bf 76 6d 66 e8 A.S.<.`.e.4.vmf. 0090 97 f1 36 13 f3 a4 30 27 09 ab 6a aa 16 03 d8 2e ..6...0'..j..... 00a0 8f 39 09 ad 2a d2 5d 5a 16 c7 d2 4f 8e 70 fa 89 .9..*.]Z...O.p.. 00b0 62 e3 1e b0 75 62 95 64 be d2 aa ea 78 4c 77 ce b...ub.d....xLw. 00c0 9e 79 9b 0d 40 31 63 bf 3b 05 36 90 5e a1 94 69 .y..@1c.;.6.^..i 00d0 5a ce f3 65 96 ce 02 d3 eb 89 c4 c8 ce b9 2f d1 Z..e........../. 00e0 b3 40 b1 da 3a 90 57 0b 1e f3 a8 a4 68 14 7f d7 .@..:.W.....h... 00f0 5f 47 e7 9c 7f 95 94 89 36 62 b6 b6 b0 55 f3 b6 _G......6b...U.. 0100 a8 f7 bc 24 c3 95 d8 f3 a0 17 7a 59 09 a0 fd 2b ...$......zY...+ 0110 f7 bb 31 75 41 cf 79 87 ff 4b 4d 39 19 82 86 b4 ..1uA.y..KM9.... 0120 22 a4 65 0f 0c 1c 0c 08 4d e2 6e d1 fb e3 d8 02 ".e.....M.n..... 0130 75 76 ec 2c 5d ae e1 71 a9 0e 42 c7 3a 89 84 37 uv.,]..q..B.:..7 0140 78 7e 9b 74 3a 00 8d e0 bc 8e 37 c7 50 fa bb 1f x~.t:.....7.P... 0150 77 f6 ea ea 88 61 w....a Frame 10 (358 bytes on wire, 358 bytes captured) Arrival Time: Jan 25, 2008 11:09:48.379240000 Time delta from previous packet: 0.031352000 seconds Time since reference or first frame: 17.519742000 seconds Frame Number: 10 Packet Length: 358 bytes Capture Length: 358 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:90:7f:3e:ca:91 (00:90:7f:3e:ca:91), Dst: 00:0c:29:f4:af:90 (00:0c:29:f4:af:90) Destination: 00:0c:29:f4:af:90 (00:0c:29:f4:af:90) Source: 00:90:7f:3e:ca:91 (00:90:7f:3e:ca:91) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.152 (165.227.249.152), Dst: 165.227.249.124 (165.227.249.124) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 344 Identification: 0xa749 (42825) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0x936f [correct] Good: True Bad : False Source: 165.227.249.152 (165.227.249.152) Destination: 165.227.249.124 (165.227.249.124) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 324 Checksum: 0xfe7f [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0xC3BA98259A2BC110 Responder cookie: 0xB64E6AB079721673 Next payload: Hash (8) Version: 1.0 Exchange type: Quick Mode (32) Flags .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x953A7292 Length: 316 Encrypted payload (288 bytes) 0000 00 0c 29 f4 af 90 00 90 7f 3e ca 91 08 00 45 00 ..)......>....E. 0010 01 58 a7 49 00 00 40 11 93 6f a5 e3 f9 98 a5 e3 .X.I..@..o...... 0020 f9 7c 01 f4 01 f4 01 44 fe 7f c3 ba 98 25 9a 2b .|.....D.....%.+ 0030 c1 10 b6 4e 6a b0 79 72 16 73 08 10 20 01 95 3a ...Nj.yr.s.. ..: 0040 72 92 00 00 01 3c 4f 1c f2 dc 93 3e e9 17 8b 9e r........ 0050 42 30 62 70 37 84 36 fe 6e e3 77 e3 8f 07 c4 3c B0bp7.6.n.w....< 0060 3e 8f e5 6b e2 60 85 8d 3c 2d 3d 81 5f bc 0c 58 >..k.`..<-=._..X 0070 f6 e8 75 65 76 35 79 f6 2e f7 53 b8 32 e9 0d 8a ..uev5y...S.2... 0080 b8 8b 22 9c ca 6a 55 c9 40 64 9c f3 0f a6 92 74 .."..jU.@d.....t 0090 88 fc 04 25 e2 9c 60 59 d6 ce 24 fa 9c f1 03 b3 ...%..`Y..$..... 00a0 63 fc 2b 2d dd d5 b6 b5 38 9e 86 96 d6 5e 76 1c c.+-....8....^v. 00b0 f7 15 47 9b 8b 42 ff c3 03 4d bf 5c f9 6e 7d 5f ..G..B...M.\.n}_ 00c0 9c 51 3a 36 c0 a0 53 5a 49 ca d5 d5 b4 75 c3 fc .Q:6..SZI....u.. 00d0 b5 81 2a c6 c4 81 1b 2e 1e 55 ed 75 fd b6 5b b3 ..*......U.u..[. 00e0 ce 0e 64 67 ac 41 77 36 53 4f a3 89 60 fa cd 5d ..dg.Aw6SO..`..] 00f0 70 75 ab 84 14 97 8c 2f c4 61 6b 99 b7 60 7e 99 pu...../.ak..`~. 0100 91 f4 67 18 11 f0 b7 62 0e 6a 8e d6 75 10 59 0a ..g....b.j..u.Y. 0110 50 12 46 f4 84 f3 fb 9d b2 b4 a5 a4 40 93 58 db P.F.........@.X. 0120 ab 0b d7 a7 6e e8 cc 3b 30 84 17 47 fa c1 c9 31 ....n..;0..G...1 0130 1d 79 a0 26 aa ce 38 9d 15 82 13 af ef b7 9c 33 .y.&..8........3 0140 14 a7 40 35 3d be d9 e2 5f 61 41 9a 4e 4b 6b 45 ..@5=..._aA.NKkE 0150 1e 43 d9 b5 cf 77 d5 6a 36 a9 6c 6d 07 5b 7b 43 .C...w.j6.lm.[{C 0160 2c fc 87 2f 06 7e ,../.~ Frame 11 (102 bytes on wire, 102 bytes captured) Arrival Time: Jan 25, 2008 11:09:48.379242000 Time delta from previous packet: 0.000002000 seconds Time since reference or first frame: 17.519744000 seconds Frame Number: 11 Packet Length: 102 bytes Capture Length: 102 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:0c:29:f4:af:90 (00:0c:29:f4:af:90), Dst: 00:90:7f:3e:ca:91 (00:90:7f:3e:ca:91) Destination: 00:90:7f:3e:ca:91 (00:90:7f:3e:ca:91) Source: 00:0c:29:f4:af:90 (00:0c:29:f4:af:90) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.124 (165.227.249.124), Dst: 165.227.249.152 (165.227.249.152) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 88 Identification: 0x0154 (340) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0x3a65 [correct] Good: True Bad : False Source: 165.227.249.124 (165.227.249.124) Destination: 165.227.249.152 (165.227.249.152) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 68 Checksum: 0xae65 [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0xC3BA98259A2BC110 Responder cookie: 0xB64E6AB079721673 Next payload: Hash (8) Version: 1.0 Exchange type: Quick Mode (32) Flags .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x953A7292 Length: 60 Encrypted payload (32 bytes) 0000 00 90 7f 3e ca 91 00 0c 29 f4 af 90 08 00 45 00 ...>....).....E. 0010 00 58 01 54 00 00 40 11 3a 65 a5 e3 f9 7c a5 e3 .X.T..@.:e...|.. 0020 f9 98 01 f4 01 f4 00 44 ae 65 c3 ba 98 25 9a 2b .......D.e...%.+ 0030 c1 10 b6 4e 6a b0 79 72 16 73 08 10 20 01 95 3a ...Nj.yr.s.. ..: 0040 72 92 00 00 00 3c 19 4c 86 f4 57 6c ed 2d 3f 5c r....<.L..Wl.-?\ 0050 5a 24 5e 46 5a 84 45 c8 df 55 e5 19 b5 74 7c 62 Z$^FZ.E..U...t|b 0060 70 70 f3 ab 9e ce pp.... Frame 12 (134 bytes on wire, 134 bytes captured) Arrival Time: Jan 25, 2008 11:09:48.738866000 Time delta from previous packet: 0.359624000 seconds Time since reference or first frame: 17.879368000 seconds Frame Number: 12 Packet Length: 134 bytes Capture Length: 134 bytes Protocols in frame: eth:ip:esp:data Ethernet II, Src: 00:0c:29:f4:af:90 (00:0c:29:f4:af:90), Dst: 00:90:7f:3e:ca:91 (00:90:7f:3e:ca:91) Destination: 00:90:7f:3e:ca:91 (00:90:7f:3e:ca:91) Source: 00:0c:29:f4:af:90 (00:0c:29:f4:af:90) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.124 (165.227.249.124), Dst: 165.227.249.152 (165.227.249.152) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 120 Identification: 0x004c (76) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 240 Protocol: ESP (0x32) Header checksum: 0x8b2b [correct] Good: True Bad : False Source: 165.227.249.124 (165.227.249.124) Destination: 165.227.249.152 (165.227.249.152) Encapsulating Security Payload SPI: 0x75b45015 Sequence: 2 Data (92 bytes) 0000 00 90 7f 3e ca 91 00 0c 29 f4 af 90 08 00 45 00 ...>....).....E. 0010 00 78 00 4c 00 00 f0 32 8b 2b a5 e3 f9 7c a5 e3 .x.L...2.+...|.. 0020 f9 98 75 b4 50 15 00 00 00 02 ba 31 bf a1 02 00 ..u.P......1.... 0030 d9 89 d9 93 3f 48 f8 96 f3 02 f1 73 4d ea 41 96 ....?H.....sM.A. 0040 3c 92 a8 42 52 59 6f 46 c6 48 39 04 57 1e 46 36 <..BRYoF.H9.W.F6 0050 f8 11 16 59 65 75 45 37 49 31 b5 27 00 57 93 51 ...YeuE7I1.'.W.Q 0060 c8 06 07 d1 66 88 4b ba 64 19 f2 6a 96 7f af 90 ....f.K.d..j.... 0070 9f 5c 10 ce a9 78 e1 ff da cf f8 8f 7b aa 1a 0a .\...x......{... 0080 4c 38 e0 21 6a e1 L8.!j. Frame 13 (134 bytes on wire, 134 bytes captured) Arrival Time: Jan 25, 2008 11:09:48.739809000 Time delta from previous packet: 0.000943000 seconds Time since reference or first frame: 17.880311000 seconds Frame Number: 13 Packet Length: 134 bytes Capture Length: 134 bytes Protocols in frame: eth:ip:esp:data Ethernet II, Src: 00:90:7f:3e:ca:91 (00:90:7f:3e:ca:91), Dst: 00:0c:29:f4:af:90 (00:0c:29:f4:af:90) Destination: 00:0c:29:f4:af:90 (00:0c:29:f4:af:90) Source: 00:90:7f:3e:ca:91 (00:90:7f:3e:ca:91) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.152 (165.227.249.152), Dst: 165.227.249.124 (165.227.249.124) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 120 Identification: 0x0001 (1) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 63 Protocol: ESP (0x32) Header checksum: 0x3c77 [correct] Good: True Bad : False Source: 165.227.249.152 (165.227.249.152) Destination: 165.227.249.124 (165.227.249.124) Encapsulating Security Payload SPI: 0x9ff02b50 Sequence: 1 Data (92 bytes) 0000 00 0c 29 f4 af 90 00 90 7f 3e ca 91 08 00 45 00 ..)......>....E. 0010 00 78 00 01 00 00 3f 32 3c 77 a5 e3 f9 98 a5 e3 .x....?2.U..*W......d 0060 48 e2 51 2d 37 c7 62 3f 84 56 3a 8c 45 e7 6a 8d H.Q-7.b?.V:.E.j. 0070 f8 ee 41 da fe ef 84 cc bd e8 fc 4b 8a 1e e1 e9 ..A........K.... 0080 94 95 23 ac ce 3d ..#..= Frame 14 (118 bytes on wire, 118 bytes captured) Arrival Time: Jan 25, 2008 11:09:48.739815000 Time delta from previous packet: 0.000006000 seconds Time since reference or first frame: 17.880317000 seconds Frame Number: 14 Packet Length: 118 bytes Capture Length: 118 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:90:7f:3e:ca:91 (00:90:7f:3e:ca:91), Dst: 00:0c:29:f4:af:90 (00:0c:29:f4:af:90) Destination: 00:0c:29:f4:af:90 (00:0c:29:f4:af:90) Source: 00:90:7f:3e:ca:91 (00:90:7f:3e:ca:91) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.152 (165.227.249.152), Dst: 165.227.249.124 (165.227.249.124) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 104 Identification: 0xa74a (42826) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0x945e [correct] Good: True Bad : False Source: 165.227.249.152 (165.227.249.152) Destination: 165.227.249.124 (165.227.249.124) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 84 Checksum: 0xd9c7 [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0xC3BA98259A2BC110 Responder cookie: 0xB64E6AB079721673 Next payload: Hash (8) Version: 1.0 Exchange type: Informational (5) Flags .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0xAAB06FB1 Length: 76 Encrypted payload (48 bytes) 0000 00 0c 29 f4 af 90 00 90 7f 3e ca 91 08 00 45 00 ..)......>....E. 0010 00 68 a7 4a 00 00 40 11 94 5e a5 e3 f9 98 a5 e3 .h.J..@..^...... 0020 f9 7c 01 f4 01 f4 00 54 d9 c7 c3 ba 98 25 9a 2b .|.....T.....%.+ 0030 c1 10 b6 4e 6a b0 79 72 16 73 08 10 05 01 aa b0 ...Nj.yr.s...... 0040 6f b1 00 00 00 4c 0a 52 ff 14 a2 77 42 de f8 b2 o....L.R...wB... 0050 7e 9d cc a4 a1 b3 d6 c8 b6 0b 6d f0 fd 09 67 d9 ~.........m...g. 0060 e4 63 c2 78 3d de a9 e3 09 10 f0 24 a5 fe 62 f5 .c.x=......$..b. 0070 0d 4f db 86 a5 4d .O...M Frame 15 (134 bytes on wire, 134 bytes captured) Arrival Time: Jan 25, 2008 11:09:49.413587000 Time delta from previous packet: 0.673772000 seconds Time since reference or first frame: 18.554089000 seconds Frame Number: 15 Packet Length: 134 bytes Capture Length: 134 bytes Protocols in frame: eth:ip:esp:data Ethernet II, Src: 00:0c:29:f4:af:90 (00:0c:29:f4:af:90), Dst: 00:90:7f:3e:ca:91 (00:90:7f:3e:ca:91) Destination: 00:90:7f:3e:ca:91 (00:90:7f:3e:ca:91) Source: 00:0c:29:f4:af:90 (00:0c:29:f4:af:90) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.124 (165.227.249.124), Dst: 165.227.249.152 (165.227.249.152) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 120 Identification: 0x004d (77) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 240 Protocol: ESP (0x32) Header checksum: 0x8b2a [correct] Good: True Bad : False Source: 165.227.249.124 (165.227.249.124) Destination: 165.227.249.152 (165.227.249.152) Encapsulating Security Payload SPI: 0x75b45015 Sequence: 3 Data (92 bytes) 0000 00 90 7f 3e ca 91 00 0c 29 f4 af 90 08 00 45 00 ...>....).....E. 0010 00 78 00 4d 00 00 f0 32 8b 2a a5 e3 f9 7c a5 e3 .x.M...2.*...|.. 0020 f9 98 75 b4 50 15 00 00 00 03 a5 b5 b8 d9 64 b2 ..u.P.........d. 0030 19 e9 71 63 e3 75 36 66 11 b5 de 1c 68 75 0f 16 ..qc.u6f....hu.. 0040 6e d7 8f 46 a5 0c cb f9 39 8c be 09 b8 a0 1f ad n..F....9....... 0050 d8 cf 7d 4e e1 6c d6 bd 0d 98 8d 58 ae 6b eb 61 ..}N.l.....X.k.a 0060 3e fc a9 56 0a 6e f7 93 98 14 69 2c 87 b4 9e a4 >..V.n....i,.... 0070 6c d8 7c fb b1 0d 2c 5a 4b f7 a1 3e 62 ff ca b0 l.|...,ZK..>b... 0080 a5 ec ed 9e 56 a5 ....V. Frame 16 (134 bytes on wire, 134 bytes captured) Arrival Time: Jan 25, 2008 11:09:49.414527000 Time delta from previous packet: 0.000940000 seconds Time since reference or first frame: 18.555029000 seconds Frame Number: 16 Packet Length: 134 bytes Capture Length: 134 bytes Protocols in frame: eth:ip:esp:data Ethernet II, Src: 00:90:7f:3e:ca:91 (00:90:7f:3e:ca:91), Dst: 00:0c:29:f4:af:90 (00:0c:29:f4:af:90) Destination: 00:0c:29:f4:af:90 (00:0c:29:f4:af:90) Source: 00:90:7f:3e:ca:91 (00:90:7f:3e:ca:91) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.152 (165.227.249.152), Dst: 165.227.249.124 (165.227.249.124) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 120 Identification: 0x0002 (2) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 63 Protocol: ESP (0x32) Header checksum: 0x3c76 [correct] Good: True Bad : False Source: 165.227.249.152 (165.227.249.152) Destination: 165.227.249.124 (165.227.249.124) Encapsulating Security Payload SPI: 0x9ff02b50 Sequence: 2 Data (92 bytes) 0000 00 0c 29 f4 af 90 00 90 7f 3e ca 91 08 00 45 00 ..)......>....E. 0010 00 78 00 02 00 00 3f 32 3c 76 a5 e3 f9 98 a5 e3 .x....?2...:=.... 0080 f9 67 e2 d1 65 0f .g..e.