Frame 1 (206 bytes on wire, 206 bytes captured) Arrival Time: Dec 11, 2006 16:53:38.510864000 Time delta from previous packet: 0.000000000 seconds Time since reference or first frame: 0.000000000 seconds Frame Number: 1 Packet Length: 206 bytes Capture Length: 206 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:19:e1:68:8e:01 (00:19:e1:68:8e:01), Dst: 00:a0:eb:00:f2:75 (00:a0:eb:00:f2:75) Destination: 00:a0:eb:00:f2:75 (00:a0:eb:00:f2:75) Source: 00:19:e1:68:8e:01 (00:19:e1:68:8e:01) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.127 (165.227.249.127), Dst: 165.227.249.129 (165.227.249.129) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 192 Identification: 0x11de (4574) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0x2987 [correct] Good: True Bad : False Source: 165.227.249.127 (165.227.249.127) Destination: 165.227.249.129 (165.227.249.129) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 172 Checksum: 0x31e5 [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0x00349FDA22FE1C5E Responder cookie: 0x0000000000000000 Next payload: Security Association (1) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 164 Security Association payload Next payload: Vendor ID (13) Length: 56 Domain of interpretation: IPSEC (1) Situation: IDENTITY (1) Proposal payload # 1 Next payload: NONE (0) Length: 44 Proposal number: 1 Protocol ID: ISAKMP (1) SPI size: 0 Number of transforms: 1 Transform payload # 1 Next payload: NONE (0) Length: 36 Transform number: 1 Transform ID: KEY_IKE (1) Group-Description (4): Alternate 1024-bit MODP group (2) Authentication-Method (3): PSK (1) Encryption-Algorithm (1): 3DES-CBC (5) Hash-Algorithm (2): SHA (2) Life-Type (11): Seconds (1) Life-Duration (12): Duration-Value (28000) Vendor ID payload Next payload: Vendor ID (13) Length: 20 Vendor ID: draft-ietf-ipsec-nat-t-ike-00 Vendor ID payload Next payload: Vendor ID (13) Length: 20 Vendor ID: draft-ietf-ipsec-nat-t-ike-02 Vendor ID payload Next payload: Vendor ID (13) Length: 20 Vendor ID: unknown vendor ID: 0x1FB99487B303B5E6C4695C0F98074FF4 Vendor ID payload Next payload: NONE (0) Length: 20 Vendor ID: RFC 3706 Detecting Dead IKE Peers (DPD) 0000 00 a0 eb 00 f2 75 00 19 e1 68 8e 01 08 00 45 00 .....u...h....E. 0010 00 c0 11 de 00 00 40 11 29 87 a5 e3 f9 7f a5 e3 ......@.)....... 0020 f9 81 01 f4 01 f4 00 ac 31 e5 00 34 9f da 22 fe ........1..4..". 0030 1c 5e 00 00 00 00 00 00 00 00 01 10 02 00 00 00 .^.............. 0040 00 00 00 00 00 a4 0d 00 00 38 00 00 00 01 00 00 .........8...... 0050 00 01 00 00 00 2c 01 01 00 01 00 00 00 24 01 01 .....,.......$.. 0060 00 00 80 04 00 02 80 03 00 01 80 01 00 05 80 02 ................ 0070 00 02 80 0b 00 01 00 0c 00 04 00 00 6d 60 0d 00 ............m`.. 0080 00 14 44 85 15 2d 18 b6 bb cd 0b e8 a8 46 95 79 ..D..-.......F.y 0090 dd cc 0d 00 00 14 90 cb 80 91 3e bb 69 6e 08 63 ..........>.in.c 00a0 81 b5 ec 42 7b 1f 0d 00 00 14 1f b9 94 87 b3 03 ...B{........... 00b0 b5 e6 c4 69 5c 0f 98 07 4f f4 00 00 00 14 af ca ...i\...O....... 00c0 d7 13 68 a1 f1 c9 6b 86 96 fc 77 57 01 00 ..h...k...wW.. Frame 2 (126 bytes on wire, 126 bytes captured) Arrival Time: Dec 11, 2006 16:53:38.512619000 Time delta from previous packet: 0.001755000 seconds Time since reference or first frame: 0.001755000 seconds Frame Number: 2 Packet Length: 126 bytes Capture Length: 126 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:a0:eb:00:f2:75 (00:a0:eb:00:f2:75), Dst: 00:19:e1:68:8e:01 (00:19:e1:68:8e:01) Destination: 00:19:e1:68:8e:01 (00:19:e1:68:8e:01) Source: 00:a0:eb:00:f2:75 (00:a0:eb:00:f2:75) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.129 (165.227.249.129), Dst: 165.227.249.127 (165.227.249.127) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 112 Identification: 0x0007 (7) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0x3bae [correct] Good: True Bad : False Source: 165.227.249.129 (165.227.249.129) Destination: 165.227.249.127 (165.227.249.127) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 92 Checksum: 0x8264 [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0x00349FDA22FE1C5E Responder cookie: 0xB49ABE9D1FE1D418 Next payload: Security Association (1) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 84 Security Association payload Next payload: NONE (0) Length: 56 Domain of interpretation: IPSEC (1) Situation: IDENTITY (1) Proposal payload # 1 Next payload: NONE (0) Length: 44 Proposal number: 1 Protocol ID: ISAKMP (1) SPI size: 0 Number of transforms: 1 Transform payload # 1 Next payload: NONE (0) Length: 36 Transform number: 1 Transform ID: KEY_IKE (1) Group-Description (4): Alternate 1024-bit MODP group (2) Authentication-Method (3): PSK (1) Encryption-Algorithm (1): 3DES-CBC (5) Hash-Algorithm (2): SHA (2) Life-Type (11): Seconds (1) Life-Duration (12): Duration-Value (28000) 0000 00 19 e1 68 8e 01 00 a0 eb 00 f2 75 08 00 45 00 ...h.......u..E. 0010 00 70 00 07 00 00 40 11 3b ae a5 e3 f9 81 a5 e3 .p....@.;....... 0020 f9 7f 01 f4 01 f4 00 5c 82 64 00 34 9f da 22 fe .......\.d.4..". 0030 1c 5e b4 9a be 9d 1f e1 d4 18 01 10 02 00 00 00 .^.............. 0040 00 00 00 00 00 54 00 00 00 38 00 00 00 01 00 00 .....T...8...... 0050 00 01 00 00 00 2c 01 01 00 01 00 00 00 24 01 01 .....,.......$.. 0060 00 00 80 04 00 02 80 03 00 01 80 01 00 05 80 02 ................ 0070 00 02 80 0b 00 01 00 0c 00 04 00 00 6d 60 ............m` Frame 3 (214 bytes on wire, 214 bytes captured) Arrival Time: Dec 11, 2006 16:53:38.763739000 Time delta from previous packet: 0.251120000 seconds Time since reference or first frame: 0.252875000 seconds Frame Number: 3 Packet Length: 214 bytes Capture Length: 214 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:19:e1:68:8e:01 (00:19:e1:68:8e:01), Dst: 00:a0:eb:00:f2:75 (00:a0:eb:00:f2:75) Destination: 00:a0:eb:00:f2:75 (00:a0:eb:00:f2:75) Source: 00:19:e1:68:8e:01 (00:19:e1:68:8e:01) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.127 (165.227.249.127), Dst: 165.227.249.129 (165.227.249.129) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 200 Identification: 0x11df (4575) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0x297e [correct] Good: True Bad : False Source: 165.227.249.127 (165.227.249.127) Destination: 165.227.249.129 (165.227.249.129) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 180 Checksum: 0x3ccb [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0x00349FDA22FE1C5E Responder cookie: 0xB49ABE9D1FE1D418 Next payload: Key Exchange (4) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 172 Key Exchange payload Next payload: Nonce (10) Length: 132 Key Exchange Data Nonce payload Next payload: NONE (0) Length: 12 Nonce Data 0000 00 a0 eb 00 f2 75 00 19 e1 68 8e 01 08 00 45 00 .....u...h....E. 0010 00 c8 11 df 00 00 40 11 29 7e a5 e3 f9 7f a5 e3 ......@.)~...... 0020 f9 81 01 f4 01 f4 00 b4 3c cb 00 34 9f da 22 fe ........<..4..". 0030 1c 5e b4 9a be 9d 1f e1 d4 18 04 10 02 00 00 00 .^.............. 0040 00 00 00 00 00 ac 0a 00 00 84 a4 80 6e ef 7a 53 ............n.zS 0050 ff f7 25 a7 61 de 21 e3 cd 76 a1 ab 26 72 72 fb ..%.a.!..v..&rr. 0060 26 c2 93 ed e5 7c 47 28 2f bf 99 4f 76 50 9e d0 &....|G(/..OvP.. 0070 08 8f 27 8d c0 39 cc 39 32 82 0f 29 3e af d5 2d ..'..9.92..)>..- 0080 6b 15 d1 c8 03 a4 a2 fe da 67 33 32 08 d3 42 d1 k........g32..B. 0090 63 43 71 0e 2c ec 8c 5e 94 d6 e6 e7 3d 56 d9 5e cCq.,..^....=V.^ 00a0 ca be 54 15 8a f5 21 fd 78 81 e6 a6 bd 4f 2c e3 ..T...!.x....O,. 00b0 ad e5 00 79 f1 5b c8 98 fc 45 f4 7a 15 af 86 6d ...y.[...E.z...m 00c0 0a eb ad 0b a7 24 62 8b 95 e1 00 00 00 0c b9 aa .....$b......... 00d0 95 d0 34 7d cd 2c ..4}., Frame 4 (222 bytes on wire, 222 bytes captured) Arrival Time: Dec 11, 2006 16:53:38.961460000 Time delta from previous packet: 0.197721000 seconds Time since reference or first frame: 0.450596000 seconds Frame Number: 4 Packet Length: 222 bytes Capture Length: 222 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:a0:eb:00:f2:75 (00:a0:eb:00:f2:75), Dst: 00:19:e1:68:8e:01 (00:19:e1:68:8e:01) Destination: 00:19:e1:68:8e:01 (00:19:e1:68:8e:01) Source: 00:a0:eb:00:f2:75 (00:a0:eb:00:f2:75) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.129 (165.227.249.129), Dst: 165.227.249.127 (165.227.249.127) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 208 Identification: 0x0008 (8) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0x3b4d [correct] Good: True Bad : False Source: 165.227.249.129 (165.227.249.129) Destination: 165.227.249.127 (165.227.249.127) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 188 Checksum: 0x1283 [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0x00349FDA22FE1C5E Responder cookie: 0xB49ABE9D1FE1D418 Next payload: Key Exchange (4) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 180 Key Exchange payload Next payload: Nonce (10) Length: 132 Key Exchange Data Nonce payload Next payload: NONE (0) Length: 20 Nonce Data 0000 00 19 e1 68 8e 01 00 a0 eb 00 f2 75 08 00 45 00 ...h.......u..E. 0010 00 d0 00 08 00 00 40 11 3b 4d a5 e3 f9 81 a5 e3 ......@.;M...... 0020 f9 7f 01 f4 01 f4 00 bc 12 83 00 34 9f da 22 fe ...........4..". 0030 1c 5e b4 9a be 9d 1f e1 d4 18 04 10 02 00 00 00 .^.............. 0040 00 00 00 00 00 b4 0a 00 00 84 ad 06 4a 1f e8 c8 ............J... 0050 b8 e6 8f bd 20 05 69 f3 c5 92 6b ee 64 3e 18 4e .... .i...k.d>.N 0060 dc a3 62 a8 68 ec bf 68 56 66 a2 66 5e c1 03 55 ..b.h..hVf.f^..U 0070 4a 5f 32 42 36 51 36 37 ec 0a c0 de 70 3a 4b 19 J_2B6Q67....p:K. 0080 c7 a2 7c c9 f6 44 b6 e3 70 93 a7 6c 11 43 23 e3 ..|..D..p..l.C#. 0090 a8 21 1a d4 11 99 70 1d 3a 0d c4 36 7a 83 65 6a .!....p.:..6z.ej 00a0 f8 f1 50 92 5f 30 ee e1 9b 5b ee 0e d9 b3 a1 f2 ..P._0...[...... 00b0 b8 15 a4 4e 3b eb 06 69 45 66 25 fd 50 8c 1f 42 ...N;..iEf%.P..B 00c0 36 71 ba e6 2d fd 37 8f 1a b2 00 00 00 14 ab fa 6q..-.7......... 00d0 e0 cb f1 b2 be b4 97 93 07 62 d9 0a 3d d3 .........b..=. Frame 5 (134 bytes on wire, 134 bytes captured) Arrival Time: Dec 11, 2006 16:53:39.243439000 Time delta from previous packet: 0.281979000 seconds Time since reference or first frame: 0.732575000 seconds Frame Number: 5 Packet Length: 134 bytes Capture Length: 134 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:19:e1:68:8e:01 (00:19:e1:68:8e:01), Dst: 00:a0:eb:00:f2:75 (00:a0:eb:00:f2:75) Destination: 00:a0:eb:00:f2:75 (00:a0:eb:00:f2:75) Source: 00:19:e1:68:8e:01 (00:19:e1:68:8e:01) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.127 (165.227.249.127), Dst: 165.227.249.129 (165.227.249.129) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 120 Identification: 0x11e0 (4576) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0x29cd [correct] Good: True Bad : False Source: 165.227.249.127 (165.227.249.127) Destination: 165.227.249.129 (165.227.249.129) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 100 Checksum: 0x6b36 [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0x00349FDA22FE1C5E Responder cookie: 0xB49ABE9D1FE1D418 Next payload: Identification (5) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 92 Encrypted payload (64 bytes) 0000 00 a0 eb 00 f2 75 00 19 e1 68 8e 01 08 00 45 00 .....u...h....E. 0010 00 78 11 e0 00 00 40 11 29 cd a5 e3 f9 7f a5 e3 .x....@.)....... 0020 f9 81 01 f4 01 f4 00 64 6b 36 00 34 9f da 22 fe .......dk6.4..". 0030 1c 5e b4 9a be 9d 1f e1 d4 18 05 10 02 01 00 00 .^.............. 0040 00 00 00 00 00 5c 7f 81 23 0b b2 63 4b 5e 7f bc .....\..#..cK^.. 0050 51 39 a3 d3 b8 69 62 26 68 02 73 97 03 a5 c0 26 Q9...ib&h.s....& 0060 34 e5 97 df 0a 6c db 5f 66 45 c8 1f e1 36 31 cd 4....l._fE...61. 0070 d2 5f ec a2 34 95 29 bf 3d 92 c0 56 81 c0 28 b1 ._..4.).=..V..(. 0080 b4 9d 25 ba a0 23 ..%..# Frame 6 (110 bytes on wire, 110 bytes captured) Arrival Time: Dec 11, 2006 16:53:39.246733000 Time delta from previous packet: 0.003294000 seconds Time since reference or first frame: 0.735869000 seconds Frame Number: 6 Packet Length: 110 bytes Capture Length: 110 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:a0:eb:00:f2:75 (00:a0:eb:00:f2:75), Dst: 00:19:e1:68:8e:01 (00:19:e1:68:8e:01) Destination: 00:19:e1:68:8e:01 (00:19:e1:68:8e:01) Source: 00:a0:eb:00:f2:75 (00:a0:eb:00:f2:75) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.129 (165.227.249.129), Dst: 165.227.249.127 (165.227.249.127) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 96 Identification: 0x0009 (9) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0x3bbc [correct] Good: True Bad : False Source: 165.227.249.129 (165.227.249.129) Destination: 165.227.249.127 (165.227.249.127) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 76 Checksum: 0xbd88 [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0x00349FDA22FE1C5E Responder cookie: 0xB49ABE9D1FE1D418 Next payload: Identification (5) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 68 Encrypted payload (40 bytes) 0000 00 19 e1 68 8e 01 00 a0 eb 00 f2 75 08 00 45 00 ...h.......u..E. 0010 00 60 00 09 00 00 40 11 3b bc a5 e3 f9 81 a5 e3 .`....@.;....... 0020 f9 7f 01 f4 01 f4 00 4c bd 88 00 34 9f da 22 fe .......L...4..". 0030 1c 5e b4 9a be 9d 1f e1 d4 18 05 10 02 01 00 00 .^.............. 0040 00 00 00 00 00 44 6d 94 a2 fa 44 8a 28 cc 12 5f .....Dm...D.(.._ 0050 2a 10 c8 c9 7b fd 7b 47 dd 2e 36 18 94 f5 ab 52 *...{.{G..6....R 0060 8f 0b 0c 6c fb 8b ab 2f e0 ca 38 73 87 c6 ...l.../..8s.. Frame 7 (342 bytes on wire, 342 bytes captured) Arrival Time: Dec 11, 2006 16:53:39.515298000 Time delta from previous packet: 0.268565000 seconds Time since reference or first frame: 1.004434000 seconds Frame Number: 7 Packet Length: 342 bytes Capture Length: 342 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:19:e1:68:8e:01 (00:19:e1:68:8e:01), Dst: 00:a0:eb:00:f2:75 (00:a0:eb:00:f2:75) Destination: 00:a0:eb:00:f2:75 (00:a0:eb:00:f2:75) Source: 00:19:e1:68:8e:01 (00:19:e1:68:8e:01) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.127 (165.227.249.127), Dst: 165.227.249.129 (165.227.249.129) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 328 Identification: 0x11e3 (4579) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0x28fa [correct] Good: True Bad : False Source: 165.227.249.127 (165.227.249.127) Destination: 165.227.249.129 (165.227.249.129) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 308 Checksum: 0x9c34 [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0x00349FDA22FE1C5E Responder cookie: 0xB49ABE9D1FE1D418 Next payload: Hash (8) Version: 1.0 Exchange type: Quick Mode (32) Flags .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0xB7756A3A Length: 300 Encrypted payload (272 bytes) 0000 00 a0 eb 00 f2 75 00 19 e1 68 8e 01 08 00 45 00 .....u...h....E. 0010 01 48 11 e3 00 00 40 11 28 fa a5 e3 f9 7f a5 e3 .H....@.(....... 0020 f9 81 01 f4 01 f4 01 34 9c 34 00 34 9f da 22 fe .......4.4.4..". 0030 1c 5e b4 9a be 9d 1f e1 d4 18 08 10 20 01 b7 75 .^.......... ..u 0040 6a 3a 00 00 01 2c 30 cb 88 24 80 5e 13 58 6e 17 j:...,0..$.^.Xn. 0050 56 76 ba fb b8 d8 b2 3f b0 f5 93 42 ea 40 83 2f Vv.....?...B.@./ 0060 43 b0 ce f6 35 dc f5 63 8a 91 15 2c be c4 c4 d8 C...5..c...,.... 0070 b8 d6 06 99 b4 c0 b5 c8 41 7a 45 d0 40 24 98 1d ........AzE.@$.. 0080 99 67 87 d0 92 72 8e 5e 4f 48 43 2a 65 a5 9b 03 .g...r.^OHC*e... 0090 8e a8 c8 9c 27 b9 59 69 5d da f0 64 ba 06 81 0e ....'.Yi]..d.... 00a0 c0 46 3a 2b d6 83 f7 b8 e8 ee 66 4a 99 73 a9 41 .F:+......fJ.s.A 00b0 6b 47 de 12 28 2e b1 7b 40 26 af bb 68 bc 45 23 kG..(..{@&..h.E# 00c0 e5 66 0b 5b 34 cf 98 3a cf 56 29 8d e4 b4 e6 2e .f.[4..:.V)..... 00d0 b7 0b bd 95 78 1b 77 aa fc 8d 6b a9 d3 c7 b6 0f ....x.w...k..... 00e0 26 00 4c ea d8 a0 83 2c e8 94 c6 31 71 53 e2 e1 &.L....,...1qS.. 00f0 15 a6 4f 28 ac db 5a 20 ed 66 68 a9 da 9d 0b 12 ..O(..Z .fh..... 0100 da a8 d8 8a e6 f2 1d 45 91 ae 33 6c e4 98 54 71 .......E..3l..Tq 0110 b4 5c ed b8 45 80 a0 be 71 ce 89 4d 86 34 00 18 .\..E...q..M.4.. 0120 74 16 3b 49 ed fa d4 3a 06 26 e4 1c 93 b6 9b 0c t.;I...:.&...... 0130 a5 c3 e5 9d e8 87 3d 97 6e a1 10 ca b8 c7 73 49 ......=.n.....sI 0140 b3 bd 68 9d e3 32 ca e8 46 e0 11 0f 40 18 b4 34 ..h..2..F...@..4 0150 7c 7a 53 6f 88 4d |zSo.M Frame 8 (350 bytes on wire, 350 bytes captured) Arrival Time: Dec 11, 2006 16:53:39.595068000 Time delta from previous packet: 0.079770000 seconds Time since reference or first frame: 1.084204000 seconds Frame Number: 8 Packet Length: 350 bytes Capture Length: 350 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:a0:eb:00:f2:75 (00:a0:eb:00:f2:75), Dst: 00:19:e1:68:8e:01 (00:19:e1:68:8e:01) Destination: 00:19:e1:68:8e:01 (00:19:e1:68:8e:01) Source: 00:a0:eb:00:f2:75 (00:a0:eb:00:f2:75) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.129 (165.227.249.129), Dst: 165.227.249.127 (165.227.249.127) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 336 Identification: 0x000a (10) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0x3acb [correct] Good: True Bad : False Source: 165.227.249.129 (165.227.249.129) Destination: 165.227.249.127 (165.227.249.127) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 316 Checksum: 0x35ad [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0x00349FDA22FE1C5E Responder cookie: 0xB49ABE9D1FE1D418 Next payload: Hash (8) Version: 1.0 Exchange type: Quick Mode (32) Flags .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0xB7756A3A Length: 308 Encrypted payload (280 bytes) 0000 00 19 e1 68 8e 01 00 a0 eb 00 f2 75 08 00 45 00 ...h.......u..E. 0010 01 50 00 0a 00 00 40 11 3a cb a5 e3 f9 81 a5 e3 .P....@.:....... 0020 f9 7f 01 f4 01 f4 01 3c 35 ad 00 34 9f da 22 fe .......<5..4..". 0030 1c 5e b4 9a be 9d 1f e1 d4 18 08 10 20 01 b7 75 .^.......... ..u 0040 6a 3a 00 00 01 34 3f 35 63 c7 12 a5 f7 ad 87 05 j:...4?5c....... 0050 a0 39 a5 58 c4 0a 73 13 7b 04 8d f9 c6 4d 98 19 .9.X..s.{....M.. 0060 dd 5c 5f 3b f6 71 e0 c1 d8 cb 00 ce 74 8c ff 1e .\_;.q......t... 0070 d8 b1 5c ba 6a 09 61 f7 1c 58 20 3a ec 04 7d bc ..\.j.a..X :..}. 0080 97 9e fa a4 6b 8c b2 fc 14 6b 13 36 02 74 ae 25 ....k....k.6.t.% 0090 2e ab 00 2d d7 6d aa 28 b1 6e 4f da 6f b4 e8 28 ...-.m.(.nO.o..( 00a0 bf 88 d2 92 b1 d8 f7 50 13 32 ed 86 83 f7 5d 1c .......P.2....]. 00b0 87 86 43 5c 98 08 62 74 76 5a a9 c6 ab f5 de c1 ..C\..btvZ...... 00c0 bf 12 91 f5 20 01 3c 69 de 42 44 e8 e9 44 51 c4 .... .. 0060 24 b7 69 98 dc 38 a6 d0 b7 b3 29 b9 33 91 2c 04 $.i..8....).3.,. 0070 b4 6f 5e 37 ee 7a f6 54 8b 62 53 45 11 18 .o^7.z.T.bSE.. Frame 11 (126 bytes on wire, 126 bytes captured) Arrival Time: Dec 11, 2006 16:53:42.992032000 Time delta from previous packet: 0.002445000 seconds Time since reference or first frame: 4.481168000 seconds Frame Number: 11 Packet Length: 126 bytes Capture Length: 126 bytes Protocols in frame: eth:ip:esp:data Ethernet II, Src: 00:a0:eb:00:f2:75 (00:a0:eb:00:f2:75), Dst: 00:19:e1:68:8e:01 (00:19:e1:68:8e:01) Destination: 00:19:e1:68:8e:01 (00:19:e1:68:8e:01) Source: 00:a0:eb:00:f2:75 (00:a0:eb:00:f2:75) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.129 (165.227.249.129), Dst: 165.227.249.127 (165.227.249.127) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 112 Identification: 0x7592 (30098) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: ESP (0x32) Header checksum: 0xc601 [correct] Good: True Bad : False Source: 165.227.249.129 (165.227.249.129) Destination: 165.227.249.127 (165.227.249.127) Encapsulating Security Payload SPI: 0xcc3c04c7 Sequence: 3 Data (84 bytes) 0000 00 19 e1 68 8e 01 00 a0 eb 00 f2 75 08 00 45 00 ...h.......u..E. 0010 00 70 75 92 00 00 40 32 c6 01 a5 e3 f9 81 a5 e3 .pu...@2........ 0020 f9 7f cc 3c 04 c7 00 00 00 03 00 00 00 00 00 00 ...<............ 0030 00 00 f9 51 27 c4 8c 23 e8 f9 85 39 3d a3 fe 43 ...Q'..#...9=..C 0040 4a 33 80 35 40 16 4c d1 c9 83 e3 c1 84 95 cb 27 J3.5@.L........' 0050 c4 6b a0 b8 69 83 5c 55 67 8d 60 dc f0 91 f7 98 .k..i.\Ug.`..... 0060 c2 f0 ea 37 c7 d3 93 c2 99 83 e7 dd 81 33 19 89 ...7.........3.. 0070 85 cf 95 2a 6e 7f c0 c0 50 27 e3 d3 12 ed ...*n...P'.... Frame 12 (126 bytes on wire, 126 bytes captured) Arrival Time: Dec 11, 2006 16:53:44.003212000 Time delta from previous packet: 1.011180000 seconds Time since reference or first frame: 5.492348000 seconds Frame Number: 12 Packet Length: 126 bytes Capture Length: 126 bytes Protocols in frame: eth:ip:esp:data Ethernet II, Src: 00:19:e1:68:8e:01 (00:19:e1:68:8e:01), Dst: 00:a0:eb:00:f2:75 (00:a0:eb:00:f2:75) Destination: 00:a0:eb:00:f2:75 (00:a0:eb:00:f2:75) Source: 00:19:e1:68:8e:01 (00:19:e1:68:8e:01) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.127 (165.227.249.127), Dst: 165.227.249.129 (165.227.249.129) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 112 Identification: 0x60a0 (24736) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 29 Protocol: ESP (0x32) Header checksum: 0xfdf3 [correct] Good: True Bad : False Source: 165.227.249.127 (165.227.249.127) Destination: 165.227.249.129 (165.227.249.129) Encapsulating Security Payload SPI: 0x9b0965c3 Sequence: 2 Data (84 bytes) 0000 00 a0 eb 00 f2 75 00 19 e1 68 8e 01 08 00 45 00 .....u...h....E. 0010 00 70 60 a0 00 00 1d 32 fd f3 a5 e3 f9 7f a5 e3 .p`....2........ 0020 f9 81 9b 09 65 c3 00 00 00 02 29 b9 33 91 2c 04 ....e.....).3.,. 0030 b4 6f fb a1 59 e8 9e 59 86 ba 15 f8 51 15 d3 32 .o..Y..Y....Q..2 0040 8f b5 90 cc 4f e9 f8 08 6a 6a c4 d1 25 34 ab 87 ....O...jj..%4.. 0050 e4 0b 5b 27 07 26 4c f0 99 6d fd 5b e8 9f 73 17 ..['.&L..m.[..s. 0060 15 ce 87 0c da 0d 1d 78 c8 26 f9 4b 52 91 39 b2 .......x.&.KR.9. 0070 32 15 25 2b 9a 2c 46 19 22 00 a5 f4 0c b3 2.%+.,F."..... Frame 13 (126 bytes on wire, 126 bytes captured) Arrival Time: Dec 11, 2006 16:53:44.004776000 Time delta from previous packet: 0.001564000 seconds Time since reference or first frame: 5.493912000 seconds Frame Number: 13 Packet Length: 126 bytes Capture Length: 126 bytes Protocols in frame: eth:ip:esp:data Ethernet II, Src: 00:a0:eb:00:f2:75 (00:a0:eb:00:f2:75), Dst: 00:19:e1:68:8e:01 (00:19:e1:68:8e:01) Destination: 00:19:e1:68:8e:01 (00:19:e1:68:8e:01) Source: 00:a0:eb:00:f2:75 (00:a0:eb:00:f2:75) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.129 (165.227.249.129), Dst: 165.227.249.127 (165.227.249.127) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 112 Identification: 0x7593 (30099) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: ESP (0x32) Header checksum: 0xc600 [correct] Good: True Bad : False Source: 165.227.249.129 (165.227.249.129) Destination: 165.227.249.127 (165.227.249.127) Encapsulating Security Payload SPI: 0xcc3c04c7 Sequence: 4 Data (84 bytes) 0000 00 19 e1 68 8e 01 00 a0 eb 00 f2 75 08 00 45 00 ...h.......u..E. 0010 00 70 75 93 00 00 40 32 c6 00 a5 e3 f9 81 a5 e3 .pu...@2........ 0020 f9 7f cc 3c 04 c7 00 00 00 04 e7 dd 81 33 19 89 ...<.........3.. 0030 85 cf 14 fb 09 fe 30 c2 bf ff 06 90 b5 19 3b 05 ......0.......;. 0040 3a 15 37 88 58 d0 6c b5 d3 d1 4a 18 cd c2 69 8b :.7.X.l...J...i. 0050 36 db 9e a0 44 bd 0a dd 0d 9d 5a f2 34 dd fb 71 6...D.....Z.4..q 0060 1e 8d 74 47 d2 77 52 07 71 af 97 9b 14 bc bc 8c ..tG.wR.q....... 0070 6c da 73 7c c7 e1 7e 67 22 34 0f 7a ea 6e l.s|..~g"4.z.n Frame 14 (94 bytes on wire, 94 bytes captured) Arrival Time: Dec 11, 2006 16:53:44.900156000 Time delta from previous packet: 0.895380000 seconds Time since reference or first frame: 6.389292000 seconds Frame Number: 14 Packet Length: 94 bytes Capture Length: 94 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:19:e1:68:8e:01 (00:19:e1:68:8e:01), Dst: 00:a0:eb:00:f2:75 (00:a0:eb:00:f2:75) Destination: 00:a0:eb:00:f2:75 (00:a0:eb:00:f2:75) Source: 00:19:e1:68:8e:01 (00:19:e1:68:8e:01) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.127 (165.227.249.127), Dst: 165.227.249.129 (165.227.249.129) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 80 Identification: 0x11e6 (4582) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0x29ef [correct] Good: True Bad : False Source: 165.227.249.127 (165.227.249.127) Destination: 165.227.249.129 (165.227.249.129) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 60 Checksum: 0x6503 [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0x00349FDA22FE1C5E Responder cookie: 0xB49ABE9D1FE1D418 Next payload: Hash (8) Version: 1.0 Exchange type: Quick Mode (32) Flags .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0xB7756A3A Length: 52 Encrypted payload (24 bytes) 0000 00 a0 eb 00 f2 75 00 19 e1 68 8e 01 08 00 45 00 .....u...h....E. 0010 00 50 11 e6 00 00 40 11 29 ef a5 e3 f9 7f a5 e3 .P....@.)....... 0020 f9 81 01 f4 01 f4 00 3c 65 03 00 34 9f da 22 fe ........ Frame 16 (126 bytes on wire, 126 bytes captured) Arrival Time: Dec 11, 2006 16:53:45.026204000 Time delta from previous packet: 0.001356000 seconds Time since reference or first frame: 6.515340000 seconds Frame Number: 16 Packet Length: 126 bytes Capture Length: 126 bytes Protocols in frame: eth:ip:esp:data Ethernet II, Src: 00:a0:eb:00:f2:75 (00:a0:eb:00:f2:75), Dst: 00:19:e1:68:8e:01 (00:19:e1:68:8e:01) Destination: 00:19:e1:68:8e:01 (00:19:e1:68:8e:01) Source: 00:a0:eb:00:f2:75 (00:a0:eb:00:f2:75) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.129 (165.227.249.129), Dst: 165.227.249.127 (165.227.249.127) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 112 Identification: 0x7594 (30100) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: ESP (0x32) Header checksum: 0xc5ff [correct] Good: True Bad : False Source: 165.227.249.129 (165.227.249.129) Destination: 165.227.249.127 (165.227.249.127) Encapsulating Security Payload SPI: 0xcc3c04c7 Sequence: 5 Data (84 bytes) 0000 00 19 e1 68 8e 01 00 a0 eb 00 f2 75 08 00 45 00 ...h.......u..E. 0010 00 70 75 94 00 00 40 32 c5 ff a5 e3 f9 81 a5 e3 .pu...@2........ 0020 f9 7f cc 3c 04 c7 00 00 00 05 97 9b 14 bc bc 8c ...<............ 0030 6c da 03 ff b4 b6 7d 26 a3 7e ee a9 64 2c c8 21 l.....}&.~..d,.! 0040 bb 36 1b 2e d8 04 88 c4 40 1f de ba 3d a7 f2 c8 .6......@...=... 0050 10 83 a0 11 4d 6e 18 fd 52 3b 92 da 31 dd 00 63 ....Mn..R;..1..c 0060 4b 5b a6 4f 70 f9 82 be 2e c9 dd 6d 18 74 b5 fa K[.Op......m.t.. 0070 3a 0e b6 3c 38 98 86 d3 9f 5a 9b c9 4d 83 :..<8....Z..M.