Frame 1 (222 bytes on wire, 222 bytes captured) Arrival Time: Aug 13, 2006 11:35:55.582296000 Time delta from previous packet: 0.000000000 seconds Time since reference or first frame: 0.000000000 seconds Frame Number: 1 Packet Length: 222 bytes Capture Length: 222 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa), Dst: 00:06:b1:22:73:e9 (00:06:b1:22:73:e9) Destination: 00:06:b1:22:73:e9 (00:06:b1:22:73:e9) Source: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.150 (165.227.249.150), Dst: 165.227.249.104 (165.227.249.104) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 208 Identification: 0x01ac (428) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: UDP (0x11) Header checksum: 0xf9aa [correct] Good: True Bad : False Source: 165.227.249.150 (165.227.249.150) Destination: 165.227.249.104 (165.227.249.104) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 188 Checksum: 0xf670 [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0x219F25B938696073 Responder cookie: 0x0000000000000000 Next payload: Security Association (1) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 180 Security Association payload Next payload: Vendor ID (13) Length: 52 Domain of interpretation: IPSEC (1) Situation: IDENTITY (1) Proposal payload # 1 Next payload: NONE (0) Length: 40 Proposal number: 1 Protocol ID: ISAKMP (1) SPI size: 0 Number of transforms: 1 Transform payload # 1 Next payload: NONE (0) Length: 32 Transform number: 1 Transform ID: KEY_IKE (1) Encryption-Algorithm (1): 3DES-CBC (5) Hash-Algorithm (2): SHA (2) Group-Description (4): Alternate 1024-bit MODP group (2) Authentication-Method (3): PSK (1) Life-Type (11): Seconds (1) Life-Duration (12): Duration-Value (28800) Vendor ID payload Next payload: Vendor ID (13) Length: 20 Vendor ID: unknown vendor ID: 0x4A131C81070358455C5728F20E95452F Vendor ID payload Next payload: Vendor ID (13) Length: 20 Vendor ID: draft-ietf-ipsec-nat-t-ike-03 Vendor ID payload Next payload: Vendor ID (13) Length: 20 Vendor ID: draft-ietf-ipsec-nat-t-ike-02 Vendor ID payload Next payload: Vendor ID (13) Length: 20 Vendor ID: draft-ietf-ipsec-nat-t-ike-00 Vendor ID payload Next payload: NONE (0) Length: 20 Vendor ID: RFC 3706 Detecting Dead IKE Peers (DPD) 0000 00 06 b1 22 73 e9 00 0c 29 96 e1 fa 08 00 45 00 ..."s...).....E. 0010 00 d0 01 ac 00 00 80 11 f9 aa a5 e3 f9 96 a5 e3 ................ 0020 f9 68 01 f4 01 f4 00 bc f6 70 21 9f 25 b9 38 69 .h.......p!.%.8i 0030 60 73 00 00 00 00 00 00 00 00 01 10 02 00 00 00 `s.............. 0040 00 00 00 00 00 b4 0d 00 00 34 00 00 00 01 00 00 .........4...... 0050 00 01 00 00 00 28 01 01 00 01 00 00 00 20 01 01 .....(....... .. 0060 00 00 80 01 00 05 80 02 00 02 80 04 00 02 80 03 ................ 0070 00 01 80 0b 00 01 80 0c 70 80 0d 00 00 14 4a 13 ........p.....J. 0080 1c 81 07 03 58 45 5c 57 28 f2 0e 95 45 2f 0d 00 ....XE\W(...E/.. 0090 00 14 7d 94 19 a6 53 10 ca 6f 2c 17 9d 92 15 52 ..}...S..o,....R 00a0 9d 56 0d 00 00 14 90 cb 80 91 3e bb 69 6e 08 63 .V........>.in.c 00b0 81 b5 ec 42 7b 1f 0d 00 00 14 44 85 15 2d 18 b6 ...B{.....D..-.. 00c0 bb cd 0b e8 a8 46 95 79 dd cc 00 00 00 14 af ca .....F.y........ 00d0 d7 13 68 a1 f1 c9 6b 86 96 fc 77 57 01 00 ..h...k...wW.. Frame 2 (134 bytes on wire, 134 bytes captured) Arrival Time: Aug 13, 2006 11:35:55.590058000 Time delta from previous packet: 0.007762000 seconds Time since reference or first frame: 0.007762000 seconds Frame Number: 2 Packet Length: 134 bytes Capture Length: 134 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:06:b1:22:73:e9 (00:06:b1:22:73:e9), Dst: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa) Destination: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa) Source: 00:06:b1:22:73:e9 (00:06:b1:22:73:e9) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.104 (165.227.249.104), Dst: 165.227.249.150 (165.227.249.150) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 120 Identification: 0x0001 (1) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 255 Protocol: UDP (0x11) Header checksum: 0x7cad [correct] Good: True Bad : False Source: 165.227.249.104 (165.227.249.104) Destination: 165.227.249.150 (165.227.249.150) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 100 Checksum: 0x2982 [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0x219F25B938696073 Responder cookie: 0x4210787A8EB53DE1 Next payload: Security Association (1) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 92 Security Association payload Next payload: Vendor ID (13) Length: 52 Domain of interpretation: IPSEC (1) Situation: IDENTITY (1) Proposal payload # 1 Next payload: NONE (0) Length: 40 Proposal number: 1 Protocol ID: ISAKMP (1) SPI size: 0 Number of transforms: 1 Transform payload # 1 Next payload: NONE (0) Length: 32 Transform number: 1 Transform ID: KEY_IKE (1) Encryption-Algorithm (1): 3DES-CBC (5) Hash-Algorithm (2): SHA (2) Group-Description (4): Alternate 1024-bit MODP group (2) Authentication-Method (3): PSK (1) Life-Type (11): Seconds (1) Life-Duration (12): Duration-Value (28800) Vendor ID payload Next payload: NONE (0) Length: 12 Vendor ID: unknown vendor ID: 0x5B362BC820F60002 0000 00 0c 29 96 e1 fa 00 06 b1 22 73 e9 08 00 45 00 ..)......"s...E. 0010 00 78 00 01 00 00 ff 11 7c ad a5 e3 f9 68 a5 e3 .x......|....h.. 0020 f9 96 01 f4 01 f4 00 64 29 82 21 9f 25 b9 38 69 .......d).!.%.8i 0030 60 73 42 10 78 7a 8e b5 3d e1 01 10 02 00 00 00 `sB.xz..=....... 0040 00 00 00 00 00 5c 0d 00 00 34 00 00 00 01 00 00 .....\...4...... 0050 00 01 00 00 00 28 01 01 00 01 00 00 00 20 01 01 .....(....... .. 0060 00 00 80 01 00 05 80 02 00 02 80 04 00 02 80 03 ................ 0070 00 01 80 0b 00 01 80 0c 70 80 00 00 00 0c 5b 36 ........p.....[6 0080 2b c8 20 f6 00 02 +. ... Frame 3 (222 bytes on wire, 222 bytes captured) Arrival Time: Aug 13, 2006 11:35:55.634184000 Time delta from previous packet: 0.044126000 seconds Time since reference or first frame: 0.051888000 seconds Frame Number: 3 Packet Length: 222 bytes Capture Length: 222 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa), Dst: 00:06:b1:22:73:e9 (00:06:b1:22:73:e9) Destination: 00:06:b1:22:73:e9 (00:06:b1:22:73:e9) Source: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.150 (165.227.249.150), Dst: 165.227.249.104 (165.227.249.104) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 208 Identification: 0x01ad (429) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: UDP (0x11) Header checksum: 0xf9a9 [correct] Good: True Bad : False Source: 165.227.249.150 (165.227.249.150) Destination: 165.227.249.104 (165.227.249.104) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 188 Checksum: 0x4f8d [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0x219F25B938696073 Responder cookie: 0x4210787A8EB53DE1 Next payload: Key Exchange (4) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 180 Key Exchange payload Next payload: Nonce (10) Length: 132 Key Exchange Data Nonce payload Next payload: NONE (0) Length: 20 Nonce Data 0000 00 06 b1 22 73 e9 00 0c 29 96 e1 fa 08 00 45 00 ..."s...).....E. 0010 00 d0 01 ad 00 00 80 11 f9 a9 a5 e3 f9 96 a5 e3 ................ 0020 f9 68 01 f4 01 f4 00 bc 4f 8d 21 9f 25 b9 38 69 .h......O.!.%.8i 0030 60 73 42 10 78 7a 8e b5 3d e1 04 10 02 00 00 00 `sB.xz..=....... 0040 00 00 00 00 00 b4 0a 00 00 84 be 2b e0 87 ad a6 ...........+.... 0050 48 fb aa da b5 c1 e9 ff 4f 85 f3 66 bd 07 86 31 H.......O..f...1 0060 2c 80 e1 32 1c 03 ee da 31 bb 4b 44 83 74 97 05 ,..2....1.KD.t.. 0070 d3 73 bc a6 97 07 d0 fc cc c4 a4 f8 68 3c 5c ea .s..........h<\. 0080 d6 8d f7 4a 97 99 29 0d 78 59 79 d6 50 a7 63 eb ...J..).xYy.P.c. 0090 f5 f2 18 9d 75 43 f1 91 b5 76 d7 d1 94 df 96 2d ....uC...v.....- 00a0 1a 84 70 58 96 a3 63 99 6f 68 06 23 9d df 04 dc ..pX..c.oh.#.... 00b0 c5 7e 92 30 3a ec 0f b9 50 e1 1f 96 68 8e b8 37 .~.0:...P...h..7 00c0 04 ec 0f 07 85 9d 1e 27 99 78 00 00 00 14 9f e4 .......'.x...... 00d0 53 ea 78 ce 61 be 1f 72 12 08 1b dd 0d 8f S.x.a..r...... Frame 4 (270 bytes on wire, 270 bytes captured) Arrival Time: Aug 13, 2006 11:35:55.919112000 Time delta from previous packet: 0.284928000 seconds Time since reference or first frame: 0.336816000 seconds Frame Number: 4 Packet Length: 270 bytes Capture Length: 270 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:06:b1:22:73:e9 (00:06:b1:22:73:e9), Dst: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa) Destination: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa) Source: 00:06:b1:22:73:e9 (00:06:b1:22:73:e9) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.104 (165.227.249.104), Dst: 165.227.249.150 (165.227.249.150) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 256 Identification: 0x0002 (2) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 255 Protocol: UDP (0x11) Header checksum: 0x7c24 [correct] Good: True Bad : False Source: 165.227.249.104 (165.227.249.104) Destination: 165.227.249.150 (165.227.249.150) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 236 Checksum: 0x1ae6 [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0x219F25B938696073 Responder cookie: 0x4210787A8EB53DE1 Next payload: Key Exchange (4) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 228 Key Exchange payload Next payload: Nonce (10) Length: 132 Key Exchange Data Nonce payload Next payload: Vendor ID (13) Length: 24 Nonce Data Vendor ID payload Next payload: Vendor ID (13) Length: 12 Vendor ID: unknown vendor ID: 0x404BF439522CA3F6 Vendor ID payload Next payload: Vendor ID (13) Length: 12 Vendor ID: draft-beaulieu-ike-xauth-02.txt Vendor ID payload Next payload: NONE (0) Length: 20 Vendor ID: RFC 3706 Detecting Dead IKE Peers (DPD) 0000 00 0c 29 96 e1 fa 00 06 b1 22 73 e9 08 00 45 00 ..)......"s...E. 0010 01 00 00 02 00 00 ff 11 7c 24 a5 e3 f9 68 a5 e3 ........|$...h.. 0020 f9 96 01 f4 01 f4 00 ec 1a e6 21 9f 25 b9 38 69 ..........!.%.8i 0030 60 73 42 10 78 7a 8e b5 3d e1 04 10 02 00 00 00 `sB.xz..=....... 0040 00 00 00 00 00 e4 0a 00 00 84 1c b9 ea 87 b9 6b ...............k 0050 7f 9f 3a cc 3f a1 00 d7 a2 95 2a b0 f1 a1 bb dd ..:.?.....*..... 0060 db 77 95 8d f0 ef ed 6c e5 f3 63 16 bd 49 49 3b .w.....l..c..II; 0070 f1 12 00 47 8e 17 ed 81 4c f0 7e 7e 70 c7 cd 88 ...G....L.~~p... 0080 18 4e 72 8d 08 ee 97 1b 7b 6b bf 4c 41 20 f7 be .Nr.....{k.LA .. 0090 bc b5 43 66 96 2f e4 d9 cc 94 45 26 59 38 56 7a ..Cf./....E&Y8Vz 00a0 d6 5e 7e f3 15 78 85 18 3f 8f 23 35 ec 31 79 43 .^~..x..?.#5.1yC 00b0 2e 5c 6c a0 ed f7 88 ba 50 7a e0 a9 e9 bc 84 d9 .\l.....Pz...... 00c0 59 a5 06 47 27 2c e3 30 9b 64 0d 00 00 18 36 d5 Y..G',.0.d....6. 00d0 ab 3f 4d 90 b8 6c dc 97 74 48 36 43 b5 6b 36 18 .?M..l..tH6C.k6. 00e0 c2 37 0d 00 00 0c 40 4b f4 39 52 2c a3 f6 0d 00 .7....@K.9R,.... 00f0 00 0c 09 00 26 89 df d6 b7 12 00 00 00 14 af ca ....&........... 0100 d7 13 68 a1 f1 c9 6b 86 96 fc 77 57 01 00 ..h...k...wW.. Frame 5 (142 bytes on wire, 142 bytes captured) Arrival Time: Aug 13, 2006 11:35:56.020013000 Time delta from previous packet: 0.100901000 seconds Time since reference or first frame: 0.437717000 seconds Frame Number: 5 Packet Length: 142 bytes Capture Length: 142 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa), Dst: 00:06:b1:22:73:e9 (00:06:b1:22:73:e9) Destination: 00:06:b1:22:73:e9 (00:06:b1:22:73:e9) Source: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.150 (165.227.249.150), Dst: 165.227.249.104 (165.227.249.104) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 128 Identification: 0x01ae (430) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: UDP (0x11) Header checksum: 0xf9f8 [correct] Good: True Bad : False Source: 165.227.249.150 (165.227.249.150) Destination: 165.227.249.104 (165.227.249.104) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 108 Checksum: 0xc774 [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0x219F25B938696073 Responder cookie: 0x4210787A8EB53DE1 Next payload: Identification (5) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 100 Encrypted payload (72 bytes) 0000 00 06 b1 22 73 e9 00 0c 29 96 e1 fa 08 00 45 00 ..."s...).....E. 0010 00 80 01 ae 00 00 80 11 f9 f8 a5 e3 f9 96 a5 e3 ................ 0020 f9 68 01 f4 01 f4 00 6c c7 74 21 9f 25 b9 38 69 .h.....l.t!.%.8i 0030 60 73 42 10 78 7a 8e b5 3d e1 05 10 02 01 00 00 `sB.xz..=....... 0040 00 00 00 00 00 64 4b 32 0e 3b 0f e4 44 14 f0 9b .....dK2.;..D... 0050 87 8d 14 e3 63 d4 5b a1 f5 c2 cc 41 1b 75 27 5f ....c.[....A.u'_ 0060 1b 3e 71 fe 5b dc 5e 70 02 cd e5 4a 93 55 56 6c .>q.[.^p...J.UVl 0070 ca 26 03 63 c5 22 c1 0a 29 c3 2c e4 d2 7e fa 7a .&.c."..).,..~.z 0080 47 a9 56 3a 47 87 70 7b fe e6 a7 01 fa db G.V:G.p{...... Frame 6 (110 bytes on wire, 110 bytes captured) Arrival Time: Aug 13, 2006 11:35:56.020015000 Time delta from previous packet: 0.000002000 seconds Time since reference or first frame: 0.437719000 seconds Frame Number: 6 Packet Length: 110 bytes Capture Length: 110 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:06:b1:22:73:e9 (00:06:b1:22:73:e9), Dst: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa) Destination: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa) Source: 00:06:b1:22:73:e9 (00:06:b1:22:73:e9) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.104 (165.227.249.104), Dst: 165.227.249.150 (165.227.249.150) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 96 Identification: 0x0003 (3) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 255 Protocol: UDP (0x11) Header checksum: 0x7cc3 [correct] Good: True Bad : False Source: 165.227.249.104 (165.227.249.104) Destination: 165.227.249.150 (165.227.249.150) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 76 Checksum: 0x8025 [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0x219F25B938696073 Responder cookie: 0x4210787A8EB53DE1 Next payload: Identification (5) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 68 Encrypted payload (40 bytes) 0000 00 0c 29 96 e1 fa 00 06 b1 22 73 e9 08 00 45 00 ..)......"s...E. 0010 00 60 00 03 00 00 ff 11 7c c3 a5 e3 f9 68 a5 e3 .`......|....h.. 0020 f9 96 01 f4 01 f4 00 4c 80 25 21 9f 25 b9 38 69 .......L.%!.%.8i 0030 60 73 42 10 78 7a 8e b5 3d e1 05 10 02 01 00 00 `sB.xz..=....... 0040 00 00 00 00 00 44 37 fd 9b bf b6 f2 80 05 2b fd .....D7.......+. 0050 ea 42 0b 5d c2 5d 91 32 35 6f 13 b0 2f a2 6f d9 .B.].].25o../.o. 0060 c9 aa 1f 19 5a c5 d6 72 c9 b2 d5 b5 ab f4 ....Z..r...... Frame 7 (334 bytes on wire, 334 bytes captured) Arrival Time: Aug 13, 2006 11:35:56.041647000 Time delta from previous packet: 0.021632000 seconds Time since reference or first frame: 0.459351000 seconds Frame Number: 7 Packet Length: 334 bytes Capture Length: 334 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa), Dst: 00:06:b1:22:73:e9 (00:06:b1:22:73:e9) Destination: 00:06:b1:22:73:e9 (00:06:b1:22:73:e9) Source: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.150 (165.227.249.150), Dst: 165.227.249.104 (165.227.249.104) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 320 Identification: 0x01af (431) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: UDP (0x11) Header checksum: 0xf937 [correct] Good: True Bad : False Source: 165.227.249.150 (165.227.249.150) Destination: 165.227.249.104 (165.227.249.104) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 300 Checksum: 0xf068 [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0x219F25B938696073 Responder cookie: 0x4210787A8EB53DE1 Next payload: Hash (8) Version: 1.0 Exchange type: Quick Mode (32) Flags .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x4C15763D Length: 292 Encrypted payload (264 bytes) 0000 00 06 b1 22 73 e9 00 0c 29 96 e1 fa 08 00 45 00 ..."s...).....E. 0010 01 40 01 af 00 00 80 11 f9 37 a5 e3 f9 96 a5 e3 .@.......7...... 0020 f9 68 01 f4 01 f4 01 2c f0 68 21 9f 25 b9 38 69 .h.....,.h!.%.8i 0030 60 73 42 10 78 7a 8e b5 3d e1 08 10 20 01 4c 15 `sB.xz..=... .L. 0040 76 3d 00 00 01 24 73 ee b3 51 c3 84 d3 c8 50 99 v=...$s..Q....P. 0050 55 36 b0 13 98 6d b8 5f a9 0c a0 71 09 6f fc 9b U6...m._...q.o.. 0060 5f 45 ec bb 85 03 3c 6f 0c 8d c6 4a e3 04 5f 26 _E..... 0120 4e 32 c3 00 d9 42 ac 7c 70 95 85 34 34 6f 93 65 N2...B.|p..44o.e 0130 11 16 00 0b d6 44 ee 00 87 5c 42 4f 0c 97 ce 5f .....D...\BO..._ 0140 d6 4c be f2 4f a0 3e 11 88 c4 dc b9 0d 36 .L..O.>......6 Frame 8 (334 bytes on wire, 334 bytes captured) Arrival Time: Aug 13, 2006 11:35:56.414268000 Time delta from previous packet: 0.372621000 seconds Time since reference or first frame: 0.831972000 seconds Frame Number: 8 Packet Length: 334 bytes Capture Length: 334 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:06:b1:22:73:e9 (00:06:b1:22:73:e9), Dst: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa) Destination: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa) Source: 00:06:b1:22:73:e9 (00:06:b1:22:73:e9) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.104 (165.227.249.104), Dst: 165.227.249.150 (165.227.249.150) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 320 Identification: 0x0004 (4) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 255 Protocol: UDP (0x11) Header checksum: 0x7be2 [correct] Good: True Bad : False Source: 165.227.249.104 (165.227.249.104) Destination: 165.227.249.150 (165.227.249.150) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 300 Checksum: 0x523d [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0x219F25B938696073 Responder cookie: 0x4210787A8EB53DE1 Next payload: Hash (8) Version: 1.0 Exchange type: Quick Mode (32) Flags .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x4C15763D Length: 292 Encrypted payload (264 bytes) 0000 00 0c 29 96 e1 fa 00 06 b1 22 73 e9 08 00 45 00 ..)......"s...E. 0010 01 40 00 04 00 00 ff 11 7b e2 a5 e3 f9 68 a5 e3 .@......{....h.. 0020 f9 96 01 f4 01 f4 01 2c 52 3d 21 9f 25 b9 38 69 .......,R=!.%.8i 0030 60 73 42 10 78 7a 8e b5 3d e1 08 10 20 01 4c 15 `sB.xz..=... .L. 0040 76 3d 00 00 01 24 f2 ea 98 71 de 98 1e bb 80 32 v=...$...q.....2 0050 4b dd 07 99 28 6f 50 4d 8e 2f 01 1c e2 27 f3 03 K...(oPM./...'.. 0060 1e 72 b5 e6 f1 97 37 40 5b f5 4b 50 2e d4 bd 0b .r....7@[.KP.... 0070 11 20 95 07 14 11 12 0f 1a f5 f6 e7 ed 16 28 27 . ............(' 0080 df f2 c9 78 c2 a3 a9 17 d9 58 5a 33 15 76 7b 90 ...x.....XZ3.v{. 0090 12 68 d8 43 ab 41 a5 be cb 3b 98 5d 8a d0 37 39 .h.C.A...;.]..79 00a0 e7 0c a8 bf 1b 43 20 a9 a8 fa b5 82 8a 61 58 79 .....C ......aXy 00b0 3a d3 05 b5 67 39 47 aa 39 0c 81 2b d4 b0 50 10 :...g9G.9..+..P. 00c0 37 31 69 ad ee 22 11 e7 7a 54 ef 49 87 ca 9a 52 71i.."..zT.I...R 00d0 e9 b0 e5 4d 5f 3a 95 b5 f3 8f 30 54 84 80 ad 53 ...M_:....0T...S 00e0 07 4d 90 d4 00 7c 27 f9 1c 42 53 64 1e 3b de 10 .M...|'..BSd.;.. 00f0 90 3b 64 05 9a 5d 77 1d 79 6a e8 6c 9d 35 ba 2b .;d..]w.yj.l.5.+ 0100 7c b6 81 12 fd f0 b5 b0 13 1b 37 7c d2 f0 b6 96 |.........7|.... 0110 30 cb 29 59 98 a6 ad 98 e3 7f 08 6f ad d5 8c c1 0.)Y.......o.... 0120 6d bc fa cb 2d d2 55 17 47 d7 e6 a1 0d ac c7 27 m...-.U.G......' 0130 33 20 69 98 bd 63 a3 fb e5 8d c3 d0 be 9a 37 63 3 i..c........7c 0140 5d 82 38 eb 55 01 15 ad ee a4 00 b4 47 21 ].8.U.......G! Frame 9 (102 bytes on wire, 102 bytes captured) Arrival Time: Aug 13, 2006 11:35:56.511019000 Time delta from previous packet: 0.096751000 seconds Time since reference or first frame: 0.928723000 seconds Frame Number: 9 Packet Length: 102 bytes Capture Length: 102 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa), Dst: 00:06:b1:22:73:e9 (00:06:b1:22:73:e9) Destination: 00:06:b1:22:73:e9 (00:06:b1:22:73:e9) Source: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.150 (165.227.249.150), Dst: 165.227.249.104 (165.227.249.104) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 88 Identification: 0x01b0 (432) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: UDP (0x11) Header checksum: 0xfa1e [correct] Good: True Bad : False Source: 165.227.249.150 (165.227.249.150) Destination: 165.227.249.104 (165.227.249.104) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 68 Checksum: 0xd82d [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0x219F25B938696073 Responder cookie: 0x4210787A8EB53DE1 Next payload: Hash (8) Version: 1.0 Exchange type: Quick Mode (32) Flags .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x4C15763D Length: 60 Encrypted payload (32 bytes) 0000 00 06 b1 22 73 e9 00 0c 29 96 e1 fa 08 00 45 00 ..."s...).....E. 0010 00 58 01 b0 00 00 80 11 fa 1e a5 e3 f9 96 a5 e3 .X.............. 0020 f9 68 01 f4 01 f4 00 44 d8 2d 21 9f 25 b9 38 69 .h.....D.-!.%.8i 0030 60 73 42 10 78 7a 8e b5 3d e1 08 10 20 01 4c 15 `sB.xz..=... .L. 0040 76 3d 00 00 00 3c 75 b8 ed bb 4b f9 73 26 be a1 v=....I.;. 00f0 9c 0c 06 4d bf 98 84 c5 74 d2 d9 4e 04 3b b3 9b ...M....t..N.;.. 0100 f5 60 51 a2 80 12 8a dd 4f 99 0b 79 bd d6 9e 7f .`Q.....O..y.... 0110 96 5d 39 a8 5b e7 77 d4 b7 fe 79 61 1d b6 37 60 .]9.[.w...ya..7` 0120 2c 15 94 d8 ce a9 9a a5 75 9f 70 35 0f 88 ff 59 ,.......u.p5...Y 0130 96 a7 99 17 20 ce 3d 8e b1 6c 40 20 ab 02 80 7c .... .=..l@ ...| 0140 54 73 35 25 e6 27 ee 9c 4f 31 09 f3 07 47 ea 98 Ts5%.'..O1...G.. 0150 63 6c ee 17 7d 50 87 19 5d db 77 07 8f 2f e6 93 cl..}P..].w../.. 0160 08 96 3e 38 c6 93 85 ff c0 06 b5 9e b9 bd f4 b0 ..>8............ 0170 02 c4 27 bf f4 4f 24 60 e2 ba c2 6f f6 3d 90 3c ..'..O$`...o.=.< 0180 22 d8 c7 e5 fb 60 a5 00 67 e2 f5 c0 f1 c0 "....`..g..... Frame 11 (398 bytes on wire, 398 bytes captured) Arrival Time: Aug 13, 2006 11:36:03.037758000 Time delta from previous packet: 0.008880000 seconds Time since reference or first frame: 7.455462000 seconds Frame Number: 11 Packet Length: 398 bytes Capture Length: 398 bytes Protocols in frame: eth:ip:esp:data Ethernet II, Src: 00:06:b1:22:73:e9 (00:06:b1:22:73:e9), Dst: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa) Destination: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa) Source: 00:06:b1:22:73:e9 (00:06:b1:22:73:e9) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.104 (165.227.249.104), Dst: 165.227.249.150 (165.227.249.150) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 384 Identification: 0x0000 (0) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 255 Protocol: ESP (0x32) Header checksum: 0x7b85 [correct] Good: True Bad : False Source: 165.227.249.104 (165.227.249.104) Destination: 165.227.249.150 (165.227.249.150) Encapsulating Security Payload SPI: 0xfa18c6d5 Sequence: 1 Data (356 bytes) 0000 00 0c 29 96 e1 fa 00 06 b1 22 73 e9 08 00 45 00 ..)......"s...E. 0010 01 80 00 00 00 00 ff 32 7b 85 a5 e3 f9 68 a5 e3 .......2{....h.. 0020 f9 96 fa 18 c6 d5 00 00 00 01 78 04 5b 5b 87 f9 ..........x.[[.. 0030 bc e3 b2 04 f3 94 f4 9d 7d 00 79 cc 84 89 98 7d ........}.y....} 0040 bc b6 e1 dc 9b 2e cb e4 66 da 56 ef 74 8f 34 f0 ........f.V.t.4. 0050 d6 bd 7d b3 15 96 3e 8b 01 ef 21 4e 26 d7 07 c5 ..}...>...!N&... 0060 a0 a5 ae 2e 09 df b7 27 dc d5 d4 7d 6e 23 93 bf .......'...}n#.. 0070 5d 10 a6 f1 be cf 34 f3 4f 0c b6 19 3d d3 2a 3b ].....4.O...=.*; 0080 a0 88 5b 30 c4 e0 d0 71 e8 e2 be 6d cb 21 13 bf ..[0...q...m.!.. 0090 ca 31 82 91 41 f0 07 7c af 34 ab 28 76 8c c5 d6 .1..A..|.4.(v... 00a0 20 f1 bd 97 b3 62 16 d1 fa 69 9b 48 35 57 e3 4f ....b...i.H5W.O 00b0 e8 ff 5b 2b 69 cf e4 71 4d 90 80 cf 2d 27 5a 9f ..[+i..qM...-'Z. 00c0 de 67 c0 c2 8c c0 32 14 44 87 a7 00 f7 5e 80 9b .g....2.D....^.. 00d0 0c cb 93 30 47 9e 94 d7 96 0b 8a 44 85 9a f5 6e ...0G......D...n 00e0 20 c0 48 7b 89 76 4d ce 8b c3 14 68 7b 53 ab df .H{.vM....h{S.. 00f0 7d 38 73 3b 31 aa 0f 85 07 52 af c3 a2 ea af fc }8s;1....R...... 0100 f5 1c cf 7b 32 cf c6 b2 61 50 18 1d 09 a0 79 7e ...{2...aP....y~ 0110 56 55 85 bc e3 97 c7 ce ad 2d c7 d6 ad 5b 09 37 VU.......-...[.7 0120 25 bd c4 48 04 9c 3d 11 11 dc 6c 78 ec eb 85 ff %..H..=...lx.... 0130 be 31 41 2c 52 dd 67 8b 6c 20 d5 4f c0 be e2 96 .1A,R.g.l .O.... 0140 83 74 32 0d 2f b3 aa 04 64 fd 7d 49 ce 04 35 b5 .t2./...d.}I..5. 0150 4d d3 15 1c 24 df 45 3e a2 ce 9b d2 ee e7 2b ac M...$.E>......+. 0160 8e a6 78 bb 6b 4f b4 bb 2e 26 c0 45 ff de 3a b4 ..x.kO...&.E..:. 0170 55 da 5e d5 0e fa 7c 90 42 77 92 7f 73 87 ed d9 U.^...|.Bw..s... 0180 f9 47 86 0e 76 5b 2c 4f 5f 3d 5a e9 cc d9 .G..v[,O_=Z...