Frame 1 (170 bytes on wire, 170 bytes captured) Arrival Time: May 25, 2009 16:22:48.344572000 [Time delta from previous captured frame: 0.000000000 seconds] [Time delta from previous displayed frame: 0.000000000 seconds] [Time since reference or first frame: 0.000000000 seconds] Frame Number: 1 Frame Length: 170 bytes Capture Length: 170 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:e0:7b:00:0d:61 (00:e0:7b:00:0d:61), Dst: 00:24:b2:31:e1:3d (00:24:b2:31:e1:3d) Destination: 00:24:b2:31:e1:3d (00:24:b2:31:e1:3d) Address: 00:24:b2:31:e1:3d (00:24:b2:31:e1:3d) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:e0:7b:00:0d:61 (00:e0:7b:00:0d:61) Address: 00:e0:7b:00:0d:61 (00:e0:7b:00:0d:61) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.132 (165.227.249.132), Dst: 165.227.249.138 (165.227.249.138) Version: 4 Header length: 20 bytes Differentiated Services Field: 0xe0 (DSCP 0x38: Class Selector 7; ECN: 0x00) 1110 00.. = Differentiated Services Codepoint: Class Selector 7 (0x38) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 156 Identification: 0x0f8a (3978) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0x2b11 [correct] [Good: True] [Bad : False] Source: 165.227.249.132 (165.227.249.132) Destination: 165.227.249.138 (165.227.249.138) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 136 Checksum: 0x2378 [correct] [Good Checksum: True] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: 55C040A15FA49946 Responder cookie: 0000000000000000 Next payload: Security Association (1) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags: 0x00 .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 128 Security Association payload Next payload: Vendor ID (13) Payload length: 68 Domain of interpretation: IPSEC (1) Situation: IDENTITY (1) Proposal payload # 1 Next payload: NONE (0) Payload length: 56 Proposal number: 1 Protocol ID: ISAKMP (1) SPI Size: 0 Proposal transforms: 2 Transform payload # 1 Next payload: Transform (3) Payload length: 24 Transform number: 1 Transform ID: KEY_IKE (1) Encryption-Algorithm (1): 3DES-CBC (5) Hash-Algorithm (2): MD5 (1) Authentication-Method (3): PSK (1) Group-Description (4): Alternate 1024-bit MODP group (2) Transform payload # 2 Next payload: NONE (0) Payload length: 24 Transform number: 2 Transform ID: KEY_IKE (1) Encryption-Algorithm (1): 3DES-CBC (5) Hash-Algorithm (2): SHA (2) Authentication-Method (3): PSK (1) Group-Description (4): Alternate 1024-bit MODP group (2) Vendor ID: 424E455300000007 Next payload: Vendor ID (13) Payload length: 12 Vendor ID: 424E455300000007 Vendor ID: RFC 3706 Detecting Dead IKE Peers (DPD) Next payload: NONE (0) Payload length: 20 Vendor ID: RFC 3706 Detecting Dead IKE Peers (DPD) 0000 00 24 b2 31 e1 3d 00 e0 7b 00 0d 61 08 00 45 e0 .$.1.=..{..a..E. 0010 00 9c 0f 8a 00 00 40 11 2b 11 a5 e3 f9 84 a5 e3 ......@.+....... 0020 f9 8a 01 f4 01 f4 00 88 23 78 55 c0 40 a1 5f a4 ........#xU.@._. 0030 99 46 00 00 00 00 00 00 00 00 01 10 02 00 00 00 .F.............. 0040 00 00 00 00 00 80 0d 00 00 44 00 00 00 01 00 00 .........D...... 0050 00 01 00 00 00 38 01 01 00 02 03 00 00 18 01 01 .....8.......... 0060 00 00 80 01 00 05 80 02 00 01 80 03 00 01 80 04 ................ 0070 00 02 00 00 00 18 02 01 00 00 80 01 00 05 80 02 ................ 0080 00 02 80 03 00 01 80 04 00 02 0d 00 00 0c 42 4e ..............BN 0090 45 53 00 00 00 07 00 00 00 14 af ca d7 13 68 a1 ES............h. 00a0 f1 c9 6b 86 96 fc 77 57 01 00 ..k...wW.. Frame 2 (154 bytes on wire, 154 bytes captured) Arrival Time: May 25, 2009 16:22:48.551825000 [Time delta from previous captured frame: 0.207253000 seconds] [Time delta from previous displayed frame: 0.207253000 seconds] [Time since reference or first frame: 0.207253000 seconds] Frame Number: 2 Frame Length: 154 bytes Capture Length: 154 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:24:b2:31:e1:3d (00:24:b2:31:e1:3d), Dst: 00:e0:7b:00:0d:61 (00:e0:7b:00:0d:61) Destination: 00:e0:7b:00:0d:61 (00:e0:7b:00:0d:61) Address: 00:e0:7b:00:0d:61 (00:e0:7b:00:0d:61) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:24:b2:31:e1:3d (00:24:b2:31:e1:3d) Address: 00:24:b2:31:e1:3d (00:24:b2:31:e1:3d) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.138 (165.227.249.138), Dst: 165.227.249.132 (165.227.249.132) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 140 Identification: 0x0000 (0) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfb8a [correct] [Good: True] [Bad : False] Source: 165.227.249.138 (165.227.249.138) Destination: 165.227.249.132 (165.227.249.132) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 120 Checksum: 0x00f6 [correct] [Good Checksum: True] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: 55C040A15FA49946 Responder cookie: 5549161850A7C5A2 Next payload: Security Association (1) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags: 0x00 .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 112 Security Association payload Next payload: Vendor ID (13) Payload length: 44 Domain of interpretation: IPSEC (1) Situation: IDENTITY (1) Proposal payload # 1 Next payload: NONE (0) Payload length: 32 Proposal number: 1 Protocol ID: ISAKMP (1) SPI Size: 0 Proposal transforms: 1 Transform payload # 2 Next payload: NONE (0) Payload length: 24 Transform number: 2 Transform ID: KEY_IKE (1) Encryption-Algorithm (1): 3DES-CBC (5) Hash-Algorithm (2): SHA (2) Authentication-Method (3): PSK (1) Group-Description (4): Alternate 1024-bit MODP group (2) Vendor ID: 3B9031DCE4FCF88B489A923963DD0C49 Next payload: Vendor ID (13) Payload length: 20 Vendor ID: 3B9031DCE4FCF88B489A923963DD0C49 Vendor ID: 7003CBC1097DBE9C2600BA6983BC8B35 Next payload: NONE (0) Payload length: 20 Vendor ID: 7003CBC1097DBE9C2600BA6983BC8B35 0000 00 e0 7b 00 0d 61 00 24 b2 31 e1 3d 08 00 45 00 ..{..a.$.1.=..E. 0010 00 8c 00 00 40 00 40 11 fb 8a a5 e3 f9 8a a5 e3 ....@.@......... 0020 f9 84 01 f4 01 f4 00 78 00 f6 55 c0 40 a1 5f a4 .......x..U.@._. 0030 99 46 55 49 16 18 50 a7 c5 a2 01 10 02 00 00 00 .FUI..P......... 0040 00 00 00 00 00 70 0d 00 00 2c 00 00 00 01 00 00 .....p...,...... 0050 00 01 00 00 00 20 01 01 00 01 00 00 00 18 02 01 ..... .......... 0060 00 00 80 01 00 05 80 02 00 02 80 03 00 01 80 04 ................ 0070 00 02 0d 00 00 14 3b 90 31 dc e4 fc f8 8b 48 9a ......;.1.....H. 0080 92 39 63 dd 0c 49 00 00 00 14 70 03 cb c1 09 7d .9c..I....p....} 0090 be 9c 26 00 ba 69 83 bc 8b 35 ..&..i...5 Frame 3 (226 bytes on wire, 226 bytes captured) Arrival Time: May 25, 2009 16:22:48.630778000 [Time delta from previous captured frame: 0.078953000 seconds] [Time delta from previous displayed frame: 0.078953000 seconds] [Time since reference or first frame: 0.286206000 seconds] Frame Number: 3 Frame Length: 226 bytes Capture Length: 226 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:e0:7b:00:0d:61 (00:e0:7b:00:0d:61), Dst: 00:24:b2:31:e1:3d (00:24:b2:31:e1:3d) Destination: 00:24:b2:31:e1:3d (00:24:b2:31:e1:3d) Address: 00:24:b2:31:e1:3d (00:24:b2:31:e1:3d) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:e0:7b:00:0d:61 (00:e0:7b:00:0d:61) Address: 00:e0:7b:00:0d:61 (00:e0:7b:00:0d:61) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.132 (165.227.249.132), Dst: 165.227.249.138 (165.227.249.138) Version: 4 Header length: 20 bytes Differentiated Services Field: 0xe0 (DSCP 0x38: Class Selector 7; ECN: 0x00) 1110 00.. = Differentiated Services Codepoint: Class Selector 7 (0x38) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 212 Identification: 0x0f8c (3980) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0x2ad7 [correct] [Good: True] [Bad : False] Source: 165.227.249.132 (165.227.249.132) Destination: 165.227.249.138 (165.227.249.138) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 192 Checksum: 0x61bf [correct] [Good Checksum: True] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: 55C040A15FA49946 Responder cookie: 5549161850A7C5A2 Next payload: Key Exchange (4) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags: 0x00 .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 184 Key Exchange payload Next payload: Nonce (10) Payload length: 132 Key Exchange Data (128 bytes / 1024 bits) Nonce payload Next payload: NONE (0) Payload length: 24 Nonce Data 0000 00 24 b2 31 e1 3d 00 e0 7b 00 0d 61 08 00 45 e0 .$.1.=..{..a..E. 0010 00 d4 0f 8c 00 00 40 11 2a d7 a5 e3 f9 84 a5 e3 ......@.*....... 0020 f9 8a 01 f4 01 f4 00 c0 61 bf 55 c0 40 a1 5f a4 ........a.U.@._. 0030 99 46 55 49 16 18 50 a7 c5 a2 04 10 02 00 00 00 .FUI..P......... 0040 00 00 00 00 00 b8 0a 00 00 84 13 b8 03 45 a7 e7 .............E.. 0050 f2 ec e3 c9 ca 98 2c 86 42 fc a0 0c 51 70 7f 3e ......,.B...Qp.> 0060 48 e7 3e ea b3 60 e2 f2 76 1e 20 ff c5 be 78 97 H.>..`..v. ...x. 0070 fd dd 24 14 58 98 2a 71 09 c1 09 dc c3 2f 0c a3 ..$.X.*q...../.. 0080 69 c0 92 28 8b c9 9f f8 05 e1 07 98 93 c1 60 0b i..(..........`. 0090 b7 e1 21 a6 8c 8c a7 35 21 90 1c 80 9e 27 98 3f ..!....5!....'.? 00a0 94 b1 2c 4a 21 bb f0 7f 93 76 20 d5 9d 6a e8 cf ..,J!....v ..j.. 00b0 f9 1b 84 19 e6 e1 83 c7 6a 31 bc e2 e7 d7 e9 b8 ........j1...... 00c0 cb 49 44 22 b5 18 ce 2a 1a ce 00 00 00 18 c5 ce .ID"...*........ 00d0 7c 82 b7 b6 5d ad e9 de 78 b7 de a6 d3 e8 17 0f |...]...x....... 00e0 b0 c1 .. Frame 4 (242 bytes on wire, 242 bytes captured) Arrival Time: May 25, 2009 16:22:48.961764000 [Time delta from previous captured frame: 0.330986000 seconds] [Time delta from previous displayed frame: 0.330986000 seconds] [Time since reference or first frame: 0.617192000 seconds] Frame Number: 4 Frame Length: 242 bytes Capture Length: 242 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:24:b2:31:e1:3d (00:24:b2:31:e1:3d), Dst: 00:e0:7b:00:0d:61 (00:e0:7b:00:0d:61) Destination: 00:e0:7b:00:0d:61 (00:e0:7b:00:0d:61) Address: 00:e0:7b:00:0d:61 (00:e0:7b:00:0d:61) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:24:b2:31:e1:3d (00:24:b2:31:e1:3d) Address: 00:24:b2:31:e1:3d (00:24:b2:31:e1:3d) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.138 (165.227.249.138), Dst: 165.227.249.132 (165.227.249.132) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 228 Identification: 0x0000 (0) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfb32 [correct] [Good: True] [Bad : False] Source: 165.227.249.138 (165.227.249.138) Destination: 165.227.249.132 (165.227.249.132) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 208 Checksum: 0x218c [correct] [Good Checksum: True] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: 55C040A15FA49946 Responder cookie: 5549161850A7C5A2 Next payload: Key Exchange (4) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags: 0x00 .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 200 Key Exchange payload Next payload: Nonce (10) Payload length: 132 Key Exchange Data (128 bytes / 1024 bits) Nonce payload Next payload: Vendor ID (13) Payload length: 20 Nonce Data Vendor ID: 7003CBC1097DBE9C2600BA6983BC8B35 Next payload: NONE (0) Payload length: 20 Vendor ID: 7003CBC1097DBE9C2600BA6983BC8B35 0000 00 e0 7b 00 0d 61 00 24 b2 31 e1 3d 08 00 45 00 ..{..a.$.1.=..E. 0010 00 e4 00 00 40 00 40 11 fb 32 a5 e3 f9 8a a5 e3 ....@.@..2...... 0020 f9 84 01 f4 01 f4 00 d0 21 8c 55 c0 40 a1 5f a4 ........!.U.@._. 0030 99 46 55 49 16 18 50 a7 c5 a2 04 10 02 00 00 00 .FUI..P......... 0040 00 00 00 00 00 c8 0a 00 00 84 02 cb ec fe b7 f8 ................ 0050 1d a5 58 36 ed a4 d5 da e0 fa 9b c7 09 69 b5 e6 ..X6.........i.. 0060 e3 36 29 2e 2b 77 5d cb f8 d9 f2 2d 1d 9b d0 65 .6).+w]....-...e 0070 12 69 8b 3e f3 c6 c8 fc 42 8e 4e da 36 68 9f 74 .i.>....B.N.6h.t 0080 27 32 03 88 29 67 5e 7e ef 5d 51 01 cd 44 e1 23 '2..)g^~.]Q..D.# 0090 e2 eb e3 7f 37 cd 19 7d 7c 4f 6e 38 b8 61 48 55 ....7..}|On8.aHU 00a0 80 74 f6 08 f7 55 a2 20 fb 3a 76 eb f2 e5 3b 0d .t...U. .:v...;. 00b0 4c 73 e1 81 ab b3 99 f6 7b 6a a6 7b 14 4a 4b 23 Ls......{j.{.JK# 00c0 ba 7d c8 12 ad c6 26 e3 99 43 0d 00 00 14 b6 44 .}....&..C.....D 00d0 28 7b 0b d9 7a d0 fb 3a 04 b4 72 eb 17 9c 00 00 ({..z..:..r..... 00e0 00 14 70 03 cb c1 09 7d be 9c 26 00 ba 69 83 bc ..p....}..&..i.. 00f0 8b 35 .5 Frame 5 (134 bytes on wire, 134 bytes captured) Arrival Time: May 25, 2009 16:22:49.060034000 [Time delta from previous captured frame: 0.098270000 seconds] [Time delta from previous displayed frame: 0.098270000 seconds] [Time since reference or first frame: 0.715462000 seconds] Frame Number: 5 Frame Length: 134 bytes Capture Length: 134 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:e0:7b:00:0d:61 (00:e0:7b:00:0d:61), Dst: 00:24:b2:31:e1:3d (00:24:b2:31:e1:3d) Destination: 00:24:b2:31:e1:3d (00:24:b2:31:e1:3d) Address: 00:24:b2:31:e1:3d (00:24:b2:31:e1:3d) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:e0:7b:00:0d:61 (00:e0:7b:00:0d:61) Address: 00:e0:7b:00:0d:61 (00:e0:7b:00:0d:61) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.132 (165.227.249.132), Dst: 165.227.249.138 (165.227.249.138) Version: 4 Header length: 20 bytes Differentiated Services Field: 0xe0 (DSCP 0x38: Class Selector 7; ECN: 0x00) 1110 00.. = Differentiated Services Codepoint: Class Selector 7 (0x38) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 120 Identification: 0x0f8d (3981) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0x2b32 [correct] [Good: True] [Bad : False] Source: 165.227.249.132 (165.227.249.132) Destination: 165.227.249.138 (165.227.249.138) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 100 Checksum: 0x4430 [correct] [Good Checksum: True] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: 55C040A15FA49946 Responder cookie: 5549161850A7C5A2 Next payload: Identification (5) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags: 0x01 .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 92 Encrypted payload (64 bytes) 0000 00 24 b2 31 e1 3d 00 e0 7b 00 0d 61 08 00 45 e0 .$.1.=..{..a..E. 0010 00 78 0f 8d 00 00 40 11 2b 32 a5 e3 f9 84 a5 e3 .x....@.+2...... 0020 f9 8a 01 f4 01 f4 00 64 44 30 55 c0 40 a1 5f a4 .......dD0U.@._. 0030 99 46 55 49 16 18 50 a7 c5 a2 05 10 02 01 00 00 .FUI..P......... 0040 00 00 00 00 00 5c 87 63 3b 68 07 a9 2a f7 75 bc .....\.c;h..*.u. 0050 40 e2 ca d6 da 01 3c 3c 58 47 12 da 67 c4 2a a1 @.....< 0050 3f 7b 70 c3 ca d2 e5 9f 5b 00 41 68 dc d8 d3 22 ?{p.....[.Ah..." 0060 92 be 5e 37 30 74 91 f2 53 b4 d8 ac 44 65 ..^70t..S...De Frame 7 (126 bytes on wire, 126 bytes captured) Arrival Time: May 25, 2009 16:22:49.589253000 [Time delta from previous captured frame: 0.074129000 seconds] [Time delta from previous displayed frame: 0.074129000 seconds] [Time since reference or first frame: 1.244681000 seconds] Frame Number: 7 Frame Length: 126 bytes Capture Length: 126 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:24:b2:31:e1:3d (00:24:b2:31:e1:3d), Dst: 00:e0:7b:00:0d:61 (00:e0:7b:00:0d:61) Destination: 00:e0:7b:00:0d:61 (00:e0:7b:00:0d:61) Address: 00:e0:7b:00:0d:61 (00:e0:7b:00:0d:61) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:24:b2:31:e1:3d (00:24:b2:31:e1:3d) Address: 00:24:b2:31:e1:3d (00:24:b2:31:e1:3d) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.138 (165.227.249.138), Dst: 165.227.249.132 (165.227.249.132) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 112 Identification: 0x0000 (0) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfba6 [correct] [Good: True] [Bad : False] Source: 165.227.249.138 (165.227.249.138) Destination: 165.227.249.132 (165.227.249.132) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 92 Checksum: 0xc9fb [correct] [Good Checksum: True] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: 55C040A15FA49946 Responder cookie: 5549161850A7C5A2 Next payload: Hash (8) Version: 1.0 Exchange type: Informational (5) Flags: 0x01 .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0xa4eb44af Length: 84 Encrypted payload (56 bytes) 0000 00 e0 7b 00 0d 61 00 24 b2 31 e1 3d 08 00 45 00 ..{..a.$.1.=..E. 0010 00 70 00 00 40 00 40 11 fb a6 a5 e3 f9 8a a5 e3 .p..@.@......... 0020 f9 84 01 f4 01 f4 00 5c c9 fb 55 c0 40 a1 5f a4 .......\..U.@._. 0030 99 46 55 49 16 18 50 a7 c5 a2 08 10 05 01 a4 eb .FUI..P......... 0040 44 af 00 00 00 54 cc c6 9c f2 ab fb 9e 76 91 d6 D....T.......v.. 0050 41 a3 ed fe bd 86 26 c0 8d cb b0 ee 82 a1 61 68 A.....&.......ah 0060 a7 76 86 70 e5 9a 1d bb 93 95 2f a7 e0 4d c9 08 .v.p....../..M.. 0070 cc 26 01 f8 4f 31 8c 0b 0e 18 16 91 01 ff .&..O1........ Frame 8 (342 bytes on wire, 342 bytes captured) Arrival Time: May 25, 2009 16:22:49.687265000 [Time delta from previous captured frame: 0.098012000 seconds] [Time delta from previous displayed frame: 0.098012000 seconds] [Time since reference or first frame: 1.342693000 seconds] Frame Number: 8 Frame Length: 342 bytes Capture Length: 342 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:e0:7b:00:0d:61 (00:e0:7b:00:0d:61), Dst: 00:24:b2:31:e1:3d (00:24:b2:31:e1:3d) Destination: 00:24:b2:31:e1:3d (00:24:b2:31:e1:3d) Address: 00:24:b2:31:e1:3d (00:24:b2:31:e1:3d) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:e0:7b:00:0d:61 (00:e0:7b:00:0d:61) Address: 00:e0:7b:00:0d:61 (00:e0:7b:00:0d:61) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.132 (165.227.249.132), Dst: 165.227.249.138 (165.227.249.138) Version: 4 Header length: 20 bytes Differentiated Services Field: 0xe0 (DSCP 0x38: Class Selector 7; ECN: 0x00) 1110 00.. = Differentiated Services Codepoint: Class Selector 7 (0x38) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 328 Identification: 0x0fc0 (4032) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0x2a2f [correct] [Good: True] [Bad : False] Source: 165.227.249.132 (165.227.249.132) Destination: 165.227.249.138 (165.227.249.138) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 308 Checksum: 0x1317 [correct] [Good Checksum: True] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: 55C040A15FA49946 Responder cookie: 5549161850A7C5A2 Next payload: Hash (8) Version: 1.0 Exchange type: Quick Mode (32) Flags: 0x01 .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x919137cd Length: 300 Encrypted payload (272 bytes) 0000 00 24 b2 31 e1 3d 00 e0 7b 00 0d 61 08 00 45 e0 .$.1.=..{..a..E. 0010 01 48 0f c0 00 00 40 11 2a 2f a5 e3 f9 84 a5 e3 .H....@.*/...... 0020 f9 8a 01 f4 01 f4 01 34 13 17 55 c0 40 a1 5f a4 .......4..U.@._. 0030 99 46 55 49 16 18 50 a7 c5 a2 08 10 20 01 91 91 .FUI..P..... ... 0040 37 cd 00 00 01 2c 20 6d 38 7e 5e 65 5e 45 97 db 7...., m8~^e^E.. 0050 ef 96 e5 e4 07 af 80 fc 82 7a 65 0a 65 9e bc 8c .........ze.e... 0060 ca 97 90 75 39 fa f4 00 1b c4 25 24 36 79 cb 11 ...u9.....%$6y.. 0070 75 5a 92 48 b6 3a 50 f5 0d f2 ec bc d3 81 9a 43 uZ.H.:P........C 0080 94 1e c1 3b e0 0e 06 bb 04 ad c7 fd 2c 65 66 15 ...;........,ef. 0090 da 35 f2 13 6c ea 69 97 0e 2e 59 65 fa c5 31 df .5..l.i...Ye..1. 00a0 a0 23 7a d2 69 8a 9f 8f 94 9c f0 8e 54 5e a8 95 .#z.i.......T^.. 00b0 53 6c c7 5b 26 cf fc 56 0d 73 7c a4 a3 78 1c 2e Sl.[&..V.s|..x.. 00c0 dd ed e1 e5 66 f7 7d a5 45 b1 2e 3f 84 a8 d8 05 ....f.}.E..?.... 00d0 17 08 38 fe 39 48 e9 ce cc 1e 89 e4 6a bd 20 d3 ..8.9H......j. . 00e0 f5 91 13 91 0f ce 84 2f 1d 5d 96 f9 91 da 37 53 ......./.]....7S 00f0 a3 ca d7 26 84 a4 95 e1 c7 ec fb 39 22 60 f0 f9 ...&.......9"`.. 0100 bc 56 04 32 89 15 3e 05 9b 4f 41 c3 e1 a3 a0 3a .V.2..>..OA....: 0110 0e c6 5d f7 66 fa 6c 08 74 67 6b cb 4f 24 1b ae ..].f.l.tgk.O$.. 0120 78 15 cc 43 b8 a1 01 90 54 6a 29 34 ec f7 7a dd x..C....Tj)4..z. 0130 ff 70 46 6e 7f 84 20 b2 2d 76 96 08 5c cf c6 4f .pFn.. .-v..\..O 0140 9c fb 8c 03 0b 2b c2 84 ee f5 98 13 c4 08 89 4d .....+.........M 0150 3f b3 80 bc 4d fc ?...M. Frame 9 (342 bytes on wire, 342 bytes captured) Arrival Time: May 25, 2009 16:22:50.396081000 [Time delta from previous captured frame: 0.708816000 seconds] [Time delta from previous displayed frame: 0.708816000 seconds] [Time since reference or first frame: 2.051509000 seconds] Frame Number: 9 Frame Length: 342 bytes Capture Length: 342 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:24:b2:31:e1:3d (00:24:b2:31:e1:3d), Dst: 00:e0:7b:00:0d:61 (00:e0:7b:00:0d:61) Destination: 00:e0:7b:00:0d:61 (00:e0:7b:00:0d:61) Address: 00:e0:7b:00:0d:61 (00:e0:7b:00:0d:61) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:24:b2:31:e1:3d (00:24:b2:31:e1:3d) Address: 00:24:b2:31:e1:3d (00:24:b2:31:e1:3d) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.138 (165.227.249.138), Dst: 165.227.249.132 (165.227.249.132) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 328 Identification: 0x0000 (0) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xface [correct] [Good: True] [Bad : False] Source: 165.227.249.138 (165.227.249.138) Destination: 165.227.249.132 (165.227.249.132) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 308 Checksum: 0x0ff3 [correct] [Good Checksum: True] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: 55C040A15FA49946 Responder cookie: 5549161850A7C5A2 Next payload: Hash (8) Version: 1.0 Exchange type: Quick Mode (32) Flags: 0x01 .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x919137cd Length: 300 Encrypted payload (272 bytes) 0000 00 e0 7b 00 0d 61 00 24 b2 31 e1 3d 08 00 45 00 ..{..a.$.1.=..E. 0010 01 48 00 00 40 00 40 11 fa ce a5 e3 f9 8a a5 e3 .H..@.@......... 0020 f9 84 01 f4 01 f4 01 34 0f f3 55 c0 40 a1 5f a4 .......4..U.@._. 0030 99 46 55 49 16 18 50 a7 c5 a2 08 10 20 01 91 91 .FUI..P..... ... 0040 37 cd 00 00 01 2c 73 28 09 09 be a2 b8 aa ed 60 7....,s(.......` 0050 c0 71 f2 89 4e e1 85 35 ff ff ed 26 ba c7 b9 c0 .q..N..5...&.... 0060 d1 56 f3 9c e6 c9 e6 71 2e 3f 08 7d e4 dd 40 f4 .V.....q.?.}..@. 0070 fb c5 63 1a ae d7 1b 04 77 4b 2f d9 af 6a 2f c1 ..c.....wK/..j/. 0080 cb 92 98 cd 83 b2 ca 06 3f 5b be f8 25 22 4d 8b ........?[..%"M. 0090 0a 96 dc 19 11 58 08 1c 4e f7 15 ce 8f f9 b0 2e .....X..N....... 00a0 ac c3 03 2c 67 fa 93 e7 76 b0 09 ef 40 e5 c4 27 ...,g...v...@..' 00b0 c2 36 56 bb e9 47 77 25 68 c9 8c f6 cb 2e 76 0a .6V..Gw%h.....v. 00c0 76 c6 a7 3f 24 14 c8 78 a9 2b 6c e2 79 bc 6c e3 v..?$..x.+l.y.l. 00d0 76 d1 89 07 e6 c4 51 12 b0 d2 61 31 85 ce 48 9a v.....Q...a1..H. 00e0 6b 44 c5 14 0c 1e a8 59 e3 f8 0f 47 8d 6d ee 4a kD.....Y...G.m.J 00f0 08 2d 0f c5 3e bd fc 48 4d 83 a2 15 8d f0 11 86 .-..>..HM....... 0100 bf a5 3d 13 57 a2 55 74 a6 0b 28 3c f6 74 84 4e ..=.W.Ut..(<.t.N 0110 40 c7 d3 07 1c 60 5a 47 0d 2f a0 38 96 4d 0e 2b @....`ZG./.8.M.+ 0120 c8 62 f3 87 c8 ca 43 a4 65 89 b4 9d 48 c1 fa 81 .b....C.e...H... 0130 f6 16 51 ba f0 4c 12 84 2d 33 77 33 67 22 3f b7 ..Q..L..-3w3g"?. 0140 30 b1 90 bf ba cf b0 e2 75 8d 58 1c d7 85 24 69 0.......u.X...$i 0150 b1 56 74 bb 98 fa .Vt... Frame 10 (94 bytes on wire, 94 bytes captured) Arrival Time: May 25, 2009 16:22:50.499467000 [Time delta from previous captured frame: 0.103386000 seconds] [Time delta from previous displayed frame: 0.103386000 seconds] [Time since reference or first frame: 2.154895000 seconds] Frame Number: 10 Frame Length: 94 bytes Capture Length: 94 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] Ethernet II, Src: 00:e0:7b:00:0d:61 (00:e0:7b:00:0d:61), Dst: 00:24:b2:31:e1:3d (00:24:b2:31:e1:3d) Destination: 00:24:b2:31:e1:3d (00:24:b2:31:e1:3d) Address: 00:24:b2:31:e1:3d (00:24:b2:31:e1:3d) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:e0:7b:00:0d:61 (00:e0:7b:00:0d:61) Address: 00:e0:7b:00:0d:61 (00:e0:7b:00:0d:61) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.132 (165.227.249.132), Dst: 165.227.249.138 (165.227.249.138) Version: 4 Header length: 20 bytes Differentiated Services Field: 0xe0 (DSCP 0x38: Class Selector 7; ECN: 0x00) 1110 00.. = Differentiated Services Codepoint: Class Selector 7 (0x38) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 80 Identification: 0x0fc4 (4036) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0x2b23 [correct] [Good: True] [Bad : False] Source: 165.227.249.132 (165.227.249.132) Destination: 165.227.249.138 (165.227.249.138) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 60 Checksum: 0x56cb [correct] [Good Checksum: True] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: 55C040A15FA49946 Responder cookie: 5549161850A7C5A2 Next payload: Hash (8) Version: 1.0 Exchange type: Quick Mode (32) Flags: 0x01 .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x919137cd Length: 52 Encrypted payload (24 bytes) 0000 00 24 b2 31 e1 3d 00 e0 7b 00 0d 61 08 00 45 e0 .$.1.=..{..a..E. 0010 00 50 0f c4 00 00 40 11 2b 23 a5 e3 f9 84 a5 e3 .P....@.+#...... 0020 f9 8a 01 f4 01 f4 00 3c 56 cb 55 c0 40 a1 5f a4 ........x.n= 0030 a3 97 a3 b7 62 0e 61 44 26 34 37 39 8b 18 25 a0 ....b.aD&479..%. 0040 42 07 1f 01 c3 5c 1e 63 b2 fe 24 42 75 90 53 06 B....\.c..$Bu.S. 0050 3b 9d 5d 87 0d 0f b8 57 4b b5 bd 80 71 08 5e 27 ;.]....WK...q.^' 0060 56 8e c7 39 ed d4 9f ab 0b 93 99 7e b6 0a a8 ac V..9.......~.... 0070 35 ef 5d 25 06 79 1b 83 04 0b ad 0a bb 2c 5.]%.y......., Frame 12 (126 bytes on wire, 126 bytes captured) Arrival Time: May 25, 2009 16:22:53.497519000 [Time delta from previous captured frame: 0.004878000 seconds] [Time delta from previous displayed frame: 0.004878000 seconds] [Time since reference or first frame: 5.152947000 seconds] Frame Number: 12 Frame Length: 126 bytes Capture Length: 126 bytes [Frame is marked: False] [Protocols in frame: eth:ip:esp] Ethernet II, Src: 00:24:b2:31:e1:3d (00:24:b2:31:e1:3d), Dst: 00:e0:7b:00:0d:61 (00:e0:7b:00:0d:61) Destination: 00:e0:7b:00:0d:61 (00:e0:7b:00:0d:61) Address: 00:e0:7b:00:0d:61 (00:e0:7b:00:0d:61) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:24:b2:31:e1:3d (00:24:b2:31:e1:3d) Address: 00:24:b2:31:e1:3d (00:24:b2:31:e1:3d) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.138 (165.227.249.138), Dst: 165.227.249.132 (165.227.249.132) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 112 Identification: 0x3c55 (15445) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: ESP (0x32) Header checksum: 0xff30 [correct] [Good: True] [Bad : False] Source: 165.227.249.138 (165.227.249.138) Destination: 165.227.249.132 (165.227.249.132) Encapsulating Security Payload ESP SPI: 0x0001943e ESP Sequence: 1 0000 00 e0 7b 00 0d 61 00 24 b2 31 e1 3d 08 00 45 00 ..{..a.$.1.=..E. 0010 00 70 3c 55 00 00 40 32 ff 30 a5 e3 f9 8a a5 e3 .p....z...!y 0030 d6 0b 49 c2 33 c2 64 53 1b eb 6f 4c 6f d0 e8 38 ..I.3.dS..oLo..8 0040 be 57 39 4b 71 da 7d 3b bd f3 f4 87 6e 4d 9d eb .W9Kq.};....nM.. 0050 58 94 7b 5a 20 2d 88 ed 9d 17 6d 38 57 b8 c1 89 X.{Z -....m8W... 0060 5e 55 50 8e 29 60 4d c2 4f 39 97 1a b4 8c 2d a4 ^UP.)`M.O9....-. 0070 49 9d 2e bd ee 4c 50 01 1a 26 87 d5 a4 08 I....LP..&.... Frame 13 (126 bytes on wire, 126 bytes captured) Arrival Time: May 25, 2009 16:22:54.492510000 [Time delta from previous captured frame: 0.994991000 seconds] [Time delta from previous displayed frame: 0.994991000 seconds] [Time since reference or first frame: 6.147938000 seconds] Frame Number: 13 Frame Length: 126 bytes Capture Length: 126 bytes [Frame is marked: False] [Protocols in frame: eth:ip:esp] Ethernet II, Src: 00:e0:7b:00:0d:61 (00:e0:7b:00:0d:61), Dst: 00:24:b2:31:e1:3d (00:24:b2:31:e1:3d) Destination: 00:24:b2:31:e1:3d (00:24:b2:31:e1:3d) Address: 00:24:b2:31:e1:3d (00:24:b2:31:e1:3d) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:e0:7b:00:0d:61 (00:e0:7b:00:0d:61) Address: 00:e0:7b:00:0d:61 (00:e0:7b:00:0d:61) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.132 (165.227.249.132), Dst: 165.227.249.138 (165.227.249.138) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 112 Identification: 0x0fda (4058) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 255 Protocol: ESP (0x32) Header checksum: 0x6cab [correct] [Good: True] [Bad : False] Source: 165.227.249.132 (165.227.249.132) Destination: 165.227.249.138 (165.227.249.138) Encapsulating Security Payload ESP SPI: 0x00d0a21a ESP Sequence: 2 0000 00 24 b2 31 e1 3d 00 e0 7b 00 0d 61 08 00 45 00 .$.1.=..{..a..E. 0010 00 70 0f da 00 00 ff 32 6c ab a5 e3 f9 84 a5 e3 .p.....2l....... 0020 f9 8a 00 d0 a2 1a 00 00 00 02 99 7e b6 0a a8 ac ...........~.... 0030 35 ef 72 5a bc 31 20 8a de ee a7 0e 97 15 ad a7 5.rZ.1 ......... 0040 2b a6 6b 27 54 28 29 d8 2c 60 76 fb 72 54 5c 81 +.k'T().,`v.rT\. 0050 b3 d2 00 04 81 1d 3c b4 01 f7 a1 c7 88 24 26 4a ......<......$&J 0060 54 b5 24 1a 00 3e 00 35 14 da 52 f8 ab 3f b5 dd T.$..>.5..R..?.. 0070 b7 9e 2c c3 4b 7a b3 54 a8 d6 97 8a 1c 0a ..,.Kz.T...... Frame 14 (126 bytes on wire, 126 bytes captured) Arrival Time: May 25, 2009 16:22:54.496611000 [Time delta from previous captured frame: 0.004101000 seconds] [Time delta from previous displayed frame: 0.004101000 seconds] [Time since reference or first frame: 6.152039000 seconds] Frame Number: 14 Frame Length: 126 bytes Capture Length: 126 bytes [Frame is marked: False] [Protocols in frame: eth:ip:esp] Ethernet II, Src: 00:24:b2:31:e1:3d (00:24:b2:31:e1:3d), Dst: 00:e0:7b:00:0d:61 (00:e0:7b:00:0d:61) Destination: 00:e0:7b:00:0d:61 (00:e0:7b:00:0d:61) Address: 00:e0:7b:00:0d:61 (00:e0:7b:00:0d:61) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:24:b2:31:e1:3d (00:24:b2:31:e1:3d) Address: 00:24:b2:31:e1:3d (00:24:b2:31:e1:3d) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.138 (165.227.249.138), Dst: 165.227.249.132 (165.227.249.132) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 112 Identification: 0x128c (4748) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: ESP (0x32) Header checksum: 0x28fa [correct] [Good: True] [Bad : False] Source: 165.227.249.138 (165.227.249.138) Destination: 165.227.249.132 (165.227.249.132) Encapsulating Security Payload ESP SPI: 0x0001943e ESP Sequence: 2 0000 00 e0 7b 00 0d 61 00 24 b2 31 e1 3d 08 00 45 00 ..{..a.$.1.=..E. 0010 00 70 12 8c 00 00 40 32 28 fa a5 e3 f9 8a a5 e3 .p....@2(....... 0020 f9 84 00 01 94 3e 00 00 00 02 b9 c5 35 67 55 1b .....>......5gU. 0030 3f 9b b1 8b 0f 63 5a 78 e0 36 d6 3d 9c d8 2f 07 ?....cZx.6.=../. 0040 09 a8 78 6e 23 5d 49 e4 33 c9 6d f8 04 b3 8a 04 ..xn#]I.3.m..... 0050 74 d3 91 7b 24 bd 7a f7 fe 6e a3 fb a9 38 df 0b t..{$.z..n...8.. 0060 5c 12 52 22 cc 9d 9e f0 71 c0 6e 00 3a 42 1a 60 \.R"....q.n.:B.` 0070 94 dd 21 29 f4 ba eb 0a c0 1a 20 dd 90 ba ..!)...... ... Frame 15 (126 bytes on wire, 126 bytes captured) Arrival Time: May 25, 2009 16:22:55.492518000 [Time delta from previous captured frame: 0.995907000 seconds] [Time delta from previous displayed frame: 0.995907000 seconds] [Time since reference or first frame: 7.147946000 seconds] Frame Number: 15 Frame Length: 126 bytes Capture Length: 126 bytes [Frame is marked: False] [Protocols in frame: eth:ip:esp] Ethernet II, Src: 00:e0:7b:00:0d:61 (00:e0:7b:00:0d:61), Dst: 00:24:b2:31:e1:3d (00:24:b2:31:e1:3d) Destination: 00:24:b2:31:e1:3d (00:24:b2:31:e1:3d) Address: 00:24:b2:31:e1:3d (00:24:b2:31:e1:3d) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:e0:7b:00:0d:61 (00:e0:7b:00:0d:61) Address: 00:e0:7b:00:0d:61 (00:e0:7b:00:0d:61) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.132 (165.227.249.132), Dst: 165.227.249.138 (165.227.249.138) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 112 Identification: 0x0fdb (4059) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 255 Protocol: ESP (0x32) Header checksum: 0x6caa [correct] [Good: True] [Bad : False] Source: 165.227.249.132 (165.227.249.132) Destination: 165.227.249.138 (165.227.249.138) Encapsulating Security Payload ESP SPI: 0x00d0a21a ESP Sequence: 3 0000 00 24 b2 31 e1 3d 00 e0 7b 00 0d 61 08 00 45 00 .$.1.=..{..a..E. 0010 00 70 0f db 00 00 ff 32 6c aa a5 e3 f9 84 a5 e3 .p.....2l....... 0020 f9 8a 00 d0 a2 1a 00 00 00 03 52 f8 ab 3f b5 dd ..........R..?.. 0030 b7 9e 40 80 20 ca 7b 33 9d 26 6e 31 15 43 89 71 ..@. .{3.&n1.C.q 0040 44 61 0a 2e 34 db f6 92 62 d2 71 da be 93 e7 db Da..4...b.q..... 0050 44 1b f7 68 92 e7 24 6c 3b 31 d3 84 50 16 68 3b D..h..$l;1..P.h; 0060 2c 8d 17 d4 9c a3 bd b4 7e da db c7 f6 35 4d 6b ,.......~....5Mk 0070 0a 44 b6 97 38 a6 2e a0 e5 df b0 6b c7 e3 .D..8......k.. Frame 16 (126 bytes on wire, 126 bytes captured) Arrival Time: May 25, 2009 16:22:55.496666000 [Time delta from previous captured frame: 0.004148000 seconds] [Time delta from previous displayed frame: 0.004148000 seconds] [Time since reference or first frame: 7.152094000 seconds] Frame Number: 16 Frame Length: 126 bytes Capture Length: 126 bytes [Frame is marked: False] [Protocols in frame: eth:ip:esp] Ethernet II, Src: 00:24:b2:31:e1:3d (00:24:b2:31:e1:3d), Dst: 00:e0:7b:00:0d:61 (00:e0:7b:00:0d:61) Destination: 00:e0:7b:00:0d:61 (00:e0:7b:00:0d:61) Address: 00:e0:7b:00:0d:61 (00:e0:7b:00:0d:61) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:24:b2:31:e1:3d (00:24:b2:31:e1:3d) Address: 00:24:b2:31:e1:3d (00:24:b2:31:e1:3d) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.138 (165.227.249.138), Dst: 165.227.249.132 (165.227.249.132) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 112 Identification: 0xdbe2 (56290) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: ESP (0x32) Header checksum: 0x5fa3 [correct] [Good: True] [Bad : False] Source: 165.227.249.138 (165.227.249.138) Destination: 165.227.249.132 (165.227.249.132) Encapsulating Security Payload ESP SPI: 0x0001943e ESP Sequence: 3 0000 00 e0 7b 00 0d 61 00 24 b2 31 e1 3d 08 00 45 00 ..{..a.$.1.=..E. 0010 00 70 db e2 00 00 40 32 5f a3 a5 e3 f9 8a a5 e3 .p....@2_....... 0020 f9 84 00 01 94 3e 00 00 00 03 19 70 a3 bc 16 ce .....>.....p.... 0030 64 0b e0 43 0e 97 d4 20 47 3a 3e a9 26 9c 4b a1 d..C... G:>.&.K. 0040 5a 68 85 8c 22 eb 75 f9 dd 5c f7 fa fa 0d 2c 9f Zh..".u..\....,. 0050 a7 de 4e 61 cc e7 59 24 23 42 49 4c b7 89 97 31 ..Na..Y$#BIL...1 0060 4f 3a a9 89 3c 5d 0f e5 99 3a e7 78 74 1e 2a 44 O:..<]...:.xt.*D 0070 f1 43 96 0a 8b 28 4a 4c 09 45 89 1f 37 03 .C...(JL.E..7.