Frame 1 (222 bytes on wire, 222 bytes captured) Arrival Time: Nov 25, 2006 16:48:51.153645000 Time delta from previous packet: 0.000000000 seconds Time since reference or first frame: 0.000000000 seconds Frame Number: 1 Packet Length: 222 bytes Capture Length: 222 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa), Dst: 00:18:4d:09:98:ab (00:18:4d:09:98:ab) Destination: 00:18:4d:09:98:ab (00:18:4d:09:98:ab) Source: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.150 (165.227.249.150), Dst: 165.227.249.105 (165.227.249.105) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 208 Identification: 0x4053 (16467) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: UDP (0x11) Header checksum: 0xbb02 [correct] Good: True Bad : False Source: 165.227.249.150 (165.227.249.150) Destination: 165.227.249.105 (165.227.249.105) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 188 Checksum: 0x6afa [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0xCD8B581FD6B46F4A Responder cookie: 0x0000000000000000 Next payload: Security Association (1) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 180 Security Association payload Next payload: Vendor ID (13) Length: 52 Domain of interpretation: IPSEC (1) Situation: IDENTITY (1) Proposal payload # 1 Next payload: NONE (0) Length: 40 Proposal number: 1 Protocol ID: ISAKMP (1) SPI size: 0 Number of transforms: 1 Transform payload # 1 Next payload: NONE (0) Length: 32 Transform number: 1 Transform ID: KEY_IKE (1) Encryption-Algorithm (1): 3DES-CBC (5) Hash-Algorithm (2): SHA (2) Group-Description (4): Alternate 1024-bit MODP group (2) Authentication-Method (3): PSK (1) Life-Type (11): Seconds (1) Life-Duration (12): Duration-Value (28800) Vendor ID payload Next payload: Vendor ID (13) Length: 20 Vendor ID: unknown vendor ID: 0x4A131C81070358455C5728F20E95452F Vendor ID payload Next payload: Vendor ID (13) Length: 20 Vendor ID: draft-ietf-ipsec-nat-t-ike-03 Vendor ID payload Next payload: Vendor ID (13) Length: 20 Vendor ID: draft-ietf-ipsec-nat-t-ike-02 Vendor ID payload Next payload: Vendor ID (13) Length: 20 Vendor ID: draft-ietf-ipsec-nat-t-ike-00 Vendor ID payload Next payload: NONE (0) Length: 20 Vendor ID: RFC 3706 Detecting Dead IKE Peers (DPD) 0000 00 18 4d 09 98 ab 00 0c 29 96 e1 fa 08 00 45 00 ..M.....).....E. 0010 00 d0 40 53 00 00 80 11 bb 02 a5 e3 f9 96 a5 e3 ..@S............ 0020 f9 69 01 f4 01 f4 00 bc 6a fa cd 8b 58 1f d6 b4 .i......j...X... 0030 6f 4a 00 00 00 00 00 00 00 00 01 10 02 00 00 00 oJ.............. 0040 00 00 00 00 00 b4 0d 00 00 34 00 00 00 01 00 00 .........4...... 0050 00 01 00 00 00 28 01 01 00 01 00 00 00 20 01 01 .....(....... .. 0060 00 00 80 01 00 05 80 02 00 02 80 04 00 02 80 03 ................ 0070 00 01 80 0b 00 01 80 0c 70 80 0d 00 00 14 4a 13 ........p.....J. 0080 1c 81 07 03 58 45 5c 57 28 f2 0e 95 45 2f 0d 00 ....XE\W(...E/.. 0090 00 14 7d 94 19 a6 53 10 ca 6f 2c 17 9d 92 15 52 ..}...S..o,....R 00a0 9d 56 0d 00 00 14 90 cb 80 91 3e bb 69 6e 08 63 .V........>.in.c 00b0 81 b5 ec 42 7b 1f 0d 00 00 14 44 85 15 2d 18 b6 ...B{.....D..-.. 00c0 bb cd 0b e8 a8 46 95 79 dd cc 00 00 00 14 af ca .....F.y........ 00d0 d7 13 68 a1 f1 c9 6b 86 96 fc 77 57 01 00 ..h...k...wW.. Frame 2 (142 bytes on wire, 142 bytes captured) Arrival Time: Nov 25, 2006 16:48:51.372029000 Time delta from previous packet: 0.218384000 seconds Time since reference or first frame: 0.218384000 seconds Frame Number: 2 Packet Length: 142 bytes Capture Length: 142 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:18:4d:09:98:ab (00:18:4d:09:98:ab), Dst: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa) Destination: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa) Source: 00:18:4d:09:98:ab (00:18:4d:09:98:ab) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.105 (165.227.249.105), Dst: 165.227.249.150 (165.227.249.150) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 128 Identification: 0x0000 (0) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfba5 [correct] Good: True Bad : False Source: 165.227.249.105 (165.227.249.105) Destination: 165.227.249.150 (165.227.249.150) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 108 Checksum: 0x9e96 [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0xCD8B581FD6B46F4A Responder cookie: 0x82AD1E38CF596209 Next payload: Security Association (1) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 100 Security Association payload Next payload: Vendor ID (13) Length: 52 Domain of interpretation: IPSEC (1) Situation: IDENTITY (1) Proposal payload # 1 Next payload: NONE (0) Length: 40 Proposal number: 1 Protocol ID: ISAKMP (1) SPI size: 0 Number of transforms: 1 Transform payload # 1 Next payload: NONE (0) Length: 32 Transform number: 1 Transform ID: KEY_IKE (1) Encryption-Algorithm (1): 3DES-CBC (5) Hash-Algorithm (2): SHA (2) Group-Description (4): Alternate 1024-bit MODP group (2) Authentication-Method (3): PSK (1) Life-Type (11): Seconds (1) Life-Duration (12): Duration-Value (28800) Vendor ID payload Next payload: NONE (0) Length: 20 Vendor ID: RFC 3706 Detecting Dead IKE Peers (DPD) 0000 00 0c 29 96 e1 fa 00 18 4d 09 98 ab 08 00 45 00 ..).....M.....E. 0010 00 80 00 00 40 00 40 11 fb a5 a5 e3 f9 69 a5 e3 ....@.@......i.. 0020 f9 96 01 f4 01 f4 00 6c 9e 96 cd 8b 58 1f d6 b4 .......l....X... 0030 6f 4a 82 ad 1e 38 cf 59 62 09 01 10 02 00 00 00 oJ...8.Yb....... 0040 00 00 00 00 00 64 0d 00 00 34 00 00 00 01 00 00 .....d...4...... 0050 00 01 00 00 00 28 01 01 00 01 00 00 00 20 01 01 .....(....... .. 0060 00 00 80 01 00 05 80 02 00 02 80 04 00 02 80 03 ................ 0070 00 01 80 0b 00 01 80 0c 70 80 00 00 00 14 af ca ........p....... 0080 d7 13 68 a1 f1 c9 6b 86 96 fc 77 57 01 00 ..h...k...wW.. Frame 3 (222 bytes on wire, 222 bytes captured) Arrival Time: Nov 25, 2006 16:48:51.387999000 Time delta from previous packet: 0.015970000 seconds Time since reference or first frame: 0.234354000 seconds Frame Number: 3 Packet Length: 222 bytes Capture Length: 222 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa), Dst: 00:18:4d:09:98:ab (00:18:4d:09:98:ab) Destination: 00:18:4d:09:98:ab (00:18:4d:09:98:ab) Source: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.150 (165.227.249.150), Dst: 165.227.249.105 (165.227.249.105) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 208 Identification: 0x4054 (16468) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: UDP (0x11) Header checksum: 0xbb01 [correct] Good: True Bad : False Source: 165.227.249.150 (165.227.249.150) Destination: 165.227.249.105 (165.227.249.105) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 188 Checksum: 0x445f [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0xCD8B581FD6B46F4A Responder cookie: 0x82AD1E38CF596209 Next payload: Key Exchange (4) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 180 Key Exchange payload Next payload: Nonce (10) Length: 132 Key Exchange Data Nonce payload Next payload: NONE (0) Length: 20 Nonce Data 0000 00 18 4d 09 98 ab 00 0c 29 96 e1 fa 08 00 45 00 ..M.....).....E. 0010 00 d0 40 54 00 00 80 11 bb 01 a5 e3 f9 96 a5 e3 ..@T............ 0020 f9 69 01 f4 01 f4 00 bc 44 5f cd 8b 58 1f d6 b4 .i......D_..X... 0030 6f 4a 82 ad 1e 38 cf 59 62 09 04 10 02 00 00 00 oJ...8.Yb....... 0040 00 00 00 00 00 b4 0a 00 00 84 13 9c 16 e5 b7 6b ...............k 0050 4b 28 48 dc 0d 6f d8 24 4b 3b 14 12 5b d1 c4 af K(H..o.$K;..[... 0060 2f 5a 98 9c 8f 9b a9 3b b1 2a a1 ba 15 20 17 22 /Z.....;.*... ." 0070 9d 1d c0 d3 3b 4b 50 3f 3e da b6 f9 eb 32 d4 9e ....;KP?>....2.. 0080 6c 7a e4 db b5 d3 13 39 37 cb fc 1c d8 bb a2 10 lz.....97....... 0090 40 6a 75 2f 2f 89 72 d1 95 3d 89 71 02 1c 61 c0 @ju//.r..=.q..a. 00a0 d1 aa ee 4f 22 17 c6 7e 9f 37 0b 64 68 76 e5 b0 ...O"..~.7.dhv.. 00b0 ad 8f 75 51 a5 92 87 04 01 2d a4 9d 78 44 96 db ..uQ.....-..xD.. 00c0 38 d7 69 63 94 73 54 69 e3 26 00 00 00 14 c8 ad 8.ic.sTi.&...... 00d0 2b c2 d9 91 7c 93 cc e3 05 d2 4b ed 0c e8 +...|.....K... Frame 4 (222 bytes on wire, 222 bytes captured) Arrival Time: Nov 25, 2006 16:48:51.701981000 Time delta from previous packet: 0.313982000 seconds Time since reference or first frame: 0.548336000 seconds Frame Number: 4 Packet Length: 222 bytes Capture Length: 222 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:18:4d:09:98:ab (00:18:4d:09:98:ab), Dst: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa) Destination: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa) Source: 00:18:4d:09:98:ab (00:18:4d:09:98:ab) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.105 (165.227.249.105), Dst: 165.227.249.150 (165.227.249.150) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 208 Identification: 0x0000 (0) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfb55 [correct] Good: True Bad : False Source: 165.227.249.105 (165.227.249.105) Destination: 165.227.249.150 (165.227.249.150) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 188 Checksum: 0x3eff [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0xCD8B581FD6B46F4A Responder cookie: 0x82AD1E38CF596209 Next payload: Key Exchange (4) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 180 Key Exchange payload Next payload: Nonce (10) Length: 132 Key Exchange Data Nonce payload Next payload: NONE (0) Length: 20 Nonce Data 0000 00 0c 29 96 e1 fa 00 18 4d 09 98 ab 08 00 45 00 ..).....M.....E. 0010 00 d0 00 00 40 00 40 11 fb 55 a5 e3 f9 69 a5 e3 ....@.@..U...i.. 0020 f9 96 01 f4 01 f4 00 bc 3e ff cd 8b 58 1f d6 b4 ........>...X... 0030 6f 4a 82 ad 1e 38 cf 59 62 09 04 10 02 00 00 00 oJ...8.Yb....... 0040 00 00 00 00 00 b4 0a 00 00 84 b8 9e b6 3b d7 26 .............;.& 0050 76 c7 da 88 89 92 e5 5c 29 5a 16 77 42 ed 80 be v......\)Z.wB... 0060 13 f4 42 78 29 ed 10 0c 1e 2c 06 1b 83 2f 22 b0 ..Bx)....,.../". 0070 95 d1 e5 73 19 30 db ce 43 22 d4 e1 d6 89 08 63 ...s.0..C".....c 0080 0e bd 56 23 40 84 09 3c 67 52 ae 9e f5 da 34 ed ..V#@..p..M........ 0070 81 01 6d f3 d5 af d2 00 a5 1e 8c 68 ab 69 06 16 ..m........h.i.. 0080 de 9f 92 4f 77 7c 5e f3 90 02 fa 37 5d 49 ...Ow|^....7]I Frame 6 (110 bytes on wire, 110 bytes captured) Arrival Time: Nov 25, 2006 16:48:52.037206000 Time delta from previous packet: 0.223234000 seconds Time since reference or first frame: 0.883561000 seconds Frame Number: 6 Packet Length: 110 bytes Capture Length: 110 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:18:4d:09:98:ab (00:18:4d:09:98:ab), Dst: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa) Destination: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa) Source: 00:18:4d:09:98:ab (00:18:4d:09:98:ab) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.105 (165.227.249.105), Dst: 165.227.249.150 (165.227.249.150) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 96 Identification: 0x0000 (0) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfbc5 [correct] Good: True Bad : False Source: 165.227.249.105 (165.227.249.105) Destination: 165.227.249.150 (165.227.249.150) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 76 Checksum: 0xba82 [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0xCD8B581FD6B46F4A Responder cookie: 0x82AD1E38CF596209 Next payload: Identification (5) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 68 Encrypted payload (40 bytes) 0000 00 0c 29 96 e1 fa 00 18 4d 09 98 ab 08 00 45 00 ..).....M.....E. 0010 00 60 00 00 40 00 40 11 fb c5 a5 e3 f9 69 a5 e3 .`..@.@......i.. 0020 f9 96 01 f4 01 f4 00 4c ba 82 cd 8b 58 1f d6 b4 .......L....X... 0030 6f 4a 82 ad 1e 38 cf 59 62 09 05 10 02 01 00 00 oJ...8.Yb....... 0040 00 00 00 00 00 44 f2 47 9b c6 e9 e9 e2 08 74 47 .....D.G......tG 0050 b3 ab f4 28 70 e9 59 c5 49 56 70 05 b1 ef 6a e8 ...(p.Y.IVp...j. 0060 f0 11 0b 3c 34 0d 6d 04 5d dc 94 d6 16 c9 ...<4.m.]..... Frame 7 (334 bytes on wire, 334 bytes captured) Arrival Time: Nov 25, 2006 16:48:52.067869000 Time delta from previous packet: 0.030663000 seconds Time since reference or first frame: 0.914224000 seconds Frame Number: 7 Packet Length: 334 bytes Capture Length: 334 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa), Dst: 00:18:4d:09:98:ab (00:18:4d:09:98:ab) Destination: 00:18:4d:09:98:ab (00:18:4d:09:98:ab) Source: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.150 (165.227.249.150), Dst: 165.227.249.105 (165.227.249.105) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 320 Identification: 0x4056 (16470) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: UDP (0x11) Header checksum: 0xba8f [correct] Good: True Bad : False Source: 165.227.249.150 (165.227.249.150) Destination: 165.227.249.105 (165.227.249.105) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 300 Checksum: 0x7df1 [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0xCD8B581FD6B46F4A Responder cookie: 0x82AD1E38CF596209 Next payload: Hash (8) Version: 1.0 Exchange type: Quick Mode (32) Flags .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x64A9CA78 Length: 292 Encrypted payload (264 bytes) 0000 00 18 4d 09 98 ab 00 0c 29 96 e1 fa 08 00 45 00 ..M.....).....E. 0010 01 40 40 56 00 00 80 11 ba 8f a5 e3 f9 96 a5 e3 .@@V............ 0020 f9 69 01 f4 01 f4 01 2c 7d f1 cd 8b 58 1f d6 b4 .i.....,}...X... 0030 6f 4a 82 ad 1e 38 cf 59 62 09 08 10 20 01 64 a9 oJ...8.Yb... .d. 0040 ca 78 00 00 01 24 d9 bb 1d 47 15 8c 83 c4 fa 5b .x...$...G.....[ 0050 cc 42 18 e2 df 7d fa e9 a9 19 ba f2 14 ff 2e ca .B...}.......... 0060 c6 2c b8 43 ee 2c 41 b0 d0 b5 6c 69 f4 62 2c ce .,.C.,A...li.b,. 0070 cc f1 aa 16 d4 d0 e8 0f 09 70 96 ef 9f 45 d7 f4 .........p...E.. 0080 31 7b 09 00 03 a1 91 18 74 8e 03 14 52 2a 2a 2c 1{......t...R**, 0090 86 da bf bd 88 50 e9 30 8e b4 f0 40 f3 bf f1 36 .....P.0...@...6 00a0 e6 47 45 7b d8 b4 44 5d 5e 55 59 64 32 0f 8a d4 .GE{..D]^UYd2... 00b0 1c e7 50 83 7a 37 2c 8d fe fa c5 db 17 3a 42 d3 ..P.z7,......:B. 00c0 5e 38 9b d4 b4 94 12 fd 9a 1c 45 b4 d0 2c 69 b7 ^8........E..,i. 00d0 e1 87 53 12 e4 0b 5a 43 ae 50 a3 b6 8e 93 5e 32 ..S...ZC.P....^2 00e0 b4 14 6a 5b ec 01 e4 be b6 e2 a1 bb 6d 0f 30 45 ..j[........m.0E 00f0 a1 cf 4d ea 36 5b 97 9d 28 d4 8d 93 0f 69 fa 45 ..M.6[..(....i.E 0100 c6 dc 52 18 a4 2c 6b cf a7 a2 aa 70 fa e6 c2 bf ..R..,k....p.... 0110 8a 44 91 0c 23 41 b5 34 8d a0 c0 96 e5 50 e1 fc .D..#A.4.....P.. 0120 c5 e1 98 a9 66 19 aa dd 2a 64 2b 0b f8 74 9b bc ....f...*d+..t.. 0130 6e 16 1b 00 46 fe 7e b6 cb 71 84 43 04 40 a9 a2 n...F.~..q.C.@.. 0140 f2 fb 85 be 81 ce ed 40 7c 2c 6c c1 e4 8f .......@|,l... Frame 8 (326 bytes on wire, 326 bytes captured) Arrival Time: Nov 25, 2006 16:48:52.506619000 Time delta from previous packet: 0.438750000 seconds Time since reference or first frame: 1.352974000 seconds Frame Number: 8 Packet Length: 326 bytes Capture Length: 326 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:18:4d:09:98:ab (00:18:4d:09:98:ab), Dst: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa) Destination: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa) Source: 00:18:4d:09:98:ab (00:18:4d:09:98:ab) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.105 (165.227.249.105), Dst: 165.227.249.150 (165.227.249.150) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 312 Identification: 0x0000 (0) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfaed [correct] Good: True Bad : False Source: 165.227.249.105 (165.227.249.105) Destination: 165.227.249.150 (165.227.249.150) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 292 Checksum: 0x2fa9 [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0xCD8B581FD6B46F4A Responder cookie: 0x82AD1E38CF596209 Next payload: Hash (8) Version: 1.0 Exchange type: Quick Mode (32) Flags .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x64A9CA78 Length: 284 Encrypted payload (256 bytes) 0000 00 0c 29 96 e1 fa 00 18 4d 09 98 ab 08 00 45 00 ..).....M.....E. 0010 01 38 00 00 40 00 40 11 fa ed a5 e3 f9 69 a5 e3 .8..@.@......i.. 0020 f9 96 01 f4 01 f4 01 24 2f a9 cd 8b 58 1f d6 b4 .......$/...X... 0030 6f 4a 82 ad 1e 38 cf 59 62 09 08 10 20 01 64 a9 oJ...8.Yb... .d. 0040 ca 78 00 00 01 1c e6 56 17 5c 46 da f4 6e 4c 66 .x.....V.\F..nLf 0050 7e d4 40 a3 2d d5 e3 fa 52 80 ba 5f 5a d1 fb 91 ~.@.-...R.._Z... 0060 28 1a 56 6a 29 5b 84 c1 8b 6b e9 da bc 77 da 72 (.Vj)[...k...w.r 0070 b0 be b0 33 6b bb cf 36 ee 99 a1 6c 43 ab f3 14 ...3k..6...lC... 0080 8b 7e 42 a8 5d ed c2 98 b0 cf bd 22 ac cb b7 97 .~B.]......".... 0090 ff 36 49 99 9e 58 ab 05 6e f7 5f cf 24 cf 03 97 .6I..X..n._.$... 00a0 b7 a2 b3 a9 f7 7a ab b1 47 80 10 6b 5c 94 21 07 .....z..G..k\.!. 00b0 db 42 2a ff 69 79 c4 28 d0 a1 63 d0 e5 d8 f9 c6 .B*.iy.(..c..... 00c0 75 91 c0 cf 7b 04 ff 6b 9c 7e fe 01 0f 00 e7 0d u...{..k.~...... 00d0 c8 7c 79 d9 8f 5f eb 4d 2a 0f fd c0 5b 85 b4 2f .|y.._.M*...[../ 00e0 d6 ce 4e 14 f6 59 35 e4 d0 86 b3 3f 69 f0 a2 86 ..N..Y5....?i... 00f0 0d 50 22 21 2f c9 f7 4e 63 ec cc 8f e0 c0 73 8b .P"!/..Nc.....s. 0100 d3 5b e3 1f 07 b0 ed 47 34 ed a4 41 76 87 5d 1d .[.....G4..Av.]. 0110 fc 1d bd 10 3c 7c 8a 78 2b c0 6d 19 98 7c 2c df ....<|.x+.m..|,. 0120 a9 8e 89 16 9b c5 26 83 39 35 35 3c 5f 4d 06 55 ......&.955<_M.U 0130 2f 16 dc c8 32 52 cb df fc a4 e3 ea 15 f0 e9 a4 /...2R.......... 0140 9b 2a ef 16 c2 97 .*.... Frame 9 (102 bytes on wire, 102 bytes captured) Arrival Time: Nov 25, 2006 16:48:52.738752000 Time delta from previous packet: 0.232133000 seconds Time since reference or first frame: 1.585107000 seconds Frame Number: 9 Packet Length: 102 bytes Capture Length: 102 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa), Dst: 00:18:4d:09:98:ab (00:18:4d:09:98:ab) Destination: 00:18:4d:09:98:ab (00:18:4d:09:98:ab) Source: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.150 (165.227.249.150), Dst: 165.227.249.105 (165.227.249.105) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 88 Identification: 0x4057 (16471) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: UDP (0x11) Header checksum: 0xbb76 [correct] Good: True Bad : False Source: 165.227.249.150 (165.227.249.150) Destination: 165.227.249.105 (165.227.249.105) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 68 Checksum: 0xbd56 [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0xCD8B581FD6B46F4A Responder cookie: 0x82AD1E38CF596209 Next payload: Hash (8) Version: 1.0 Exchange type: Quick Mode (32) Flags .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x64A9CA78 Length: 60 Encrypted payload (32 bytes) 0000 00 18 4d 09 98 ab 00 0c 29 96 e1 fa 08 00 45 00 ..M.....).....E. 0010 00 58 40 57 00 00 80 11 bb 76 a5 e3 f9 96 a5 e3 .X@W.....v...... 0020 f9 69 01 f4 01 f4 00 44 bd 56 cd 8b 58 1f d6 b4 .i.....D.V..X... 0030 6f 4a 82 ad 1e 38 cf 59 62 09 08 10 20 01 64 a9 oJ...8.Yb... .d. 0040 ca 78 00 00 00 3c 95 b3 d1 67 27 ef 08 fc 56 34 .x...<...g'...V4 0050 d4 d3 40 9d ad b8 67 f9 02 13 e4 ba 66 e4 d6 94 ..@...g.....f... 0060 fe de e3 14 4a 64 ....Jd Frame 10 (398 bytes on wire, 398 bytes captured) Arrival Time: Nov 25, 2006 16:49:01.287411000 Time delta from previous packet: 8.548659000 seconds Time since reference or first frame: 10.133766000 seconds Frame Number: 10 Packet Length: 398 bytes Capture Length: 398 bytes Protocols in frame: eth:ip:esp:data Ethernet II, Src: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa), Dst: 00:18:4d:09:98:ab (00:18:4d:09:98:ab) Destination: 00:18:4d:09:98:ab (00:18:4d:09:98:ab) Source: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.150 (165.227.249.150), Dst: 165.227.249.105 (165.227.249.105) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 384 Identification: 0x4058 (16472) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: ESP (0x32) Header checksum: 0xba2c [correct] Good: True Bad : False Source: 165.227.249.150 (165.227.249.150) Destination: 165.227.249.105 (165.227.249.105) Encapsulating Security Payload SPI: 0x7c59abff Sequence: 1 Data (356 bytes) 0000 00 18 4d 09 98 ab 00 0c 29 96 e1 fa 08 00 45 00 ..M.....).....E. 0010 01 80 40 58 00 00 80 32 ba 2c a5 e3 f9 96 a5 e3 ..@X...2.,...... 0020 f9 69 7c 59 ab ff 00 00 00 01 fe e8 67 0f 52 75 .i|Y........g.Ru 0030 97 8a 62 53 ba 03 e8 d1 d5 79 e7 d3 e7 88 57 05 ..bS.....y....W. 0040 3d 7a 62 64 71 ec 56 0a 2f 00 64 58 83 55 db ec =zbdq.V./.dX.U.. 0050 98 a4 0c f8 2e 46 fd 27 b6 cc 39 b9 e1 d5 0c cd .....F.'..9..... 0060 82 e1 f4 a9 ae 62 d6 36 16 8d c6 6e 2f 4f 75 9f .....b.6...n/Ou. 0070 53 2b de 07 64 f0 3b e4 2e 7e 73 55 ef 12 40 f6 S+..d.;..~sU..@. 0080 4c f1 dc c6 dd 49 d4 a1 6d c1 c4 da e7 18 90 f9 L....I..m....... 0090 94 02 8d f4 3c 35 f6 e8 08 c5 bd a4 5a 86 77 a6 ....<5......Z.w. 00a0 71 e5 ca 4a 70 7d 3b 69 47 bb 36 98 52 d0 01 0b q..Jp};iG.6.R... 00b0 e8 4d 18 ad c6 3c 96 94 9a 29 75 56 db 56 3c ae .M...<...)uV.V<. 00c0 c8 d1 25 42 fd 6b 42 e4 7e de 77 53 72 9a 6a 0f ..%B.kB.~.wSr.j. 00d0 6f 4c e6 58 a2 1c 4c e8 2d 7e 6b 7c c5 d9 2c 68 oL.X..L.-~k|..,h 00e0 d0 bf 2a 94 c8 73 d5 f5 a3 47 d0 b8 e0 78 a9 e7 ..*..s...G...x.. 00f0 a9 2d fd 08 74 d9 34 67 5d 5a 13 cb 8a c6 37 e0 .-..t.4g]Z....7. 0100 b9 ee 91 80 46 03 8e aa 6b 71 01 3f d8 a2 0c c6 ....F...kq.?.... 0110 7e ac f7 1d 7b 4c df ce 12 7e 69 1a 75 2d c5 59 ~...{L...~i.u-.Y 0120 b5 8e e3 9a d1 27 c0 f5 3c 32 09 19 3c 04 ab 73 .....'..<2..<..s 0130 ca b1 79 1c d7 5b b9 9a 4b 1e 9f 8e 78 f9 0d ab ..y..[..K...x... 0140 a0 18 b6 73 cd ee a2 cc 48 fd 96 ed ea 4b 20 2e ...s....H....K . 0150 39 83 2a 8e de af 56 cb 62 67 27 bc 1c d5 3b 75 9.*...V.bg'...;u 0160 9e d6 c9 96 83 65 a2 56 1d 69 81 1c 46 d8 20 2c .....e.V.i..F. , 0170 0d 47 c1 fc d2 2d 1b d3 55 47 ff 11 b9 05 7a 64 .G...-..UG....zd 0180 3c c0 90 05 b5 21 2c b9 60 52 d9 4c 9a 81 <....!,.`R.L.. Frame 11 (398 bytes on wire, 398 bytes captured) Arrival Time: Nov 25, 2006 16:49:01.756690000 Time delta from previous packet: 0.469279000 seconds Time since reference or first frame: 10.603045000 seconds Frame Number: 11 Packet Length: 398 bytes Capture Length: 398 bytes Protocols in frame: eth:ip:esp:data Ethernet II, Src: 00:18:4d:09:98:ab (00:18:4d:09:98:ab), Dst: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa) Destination: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa) Source: 00:18:4d:09:98:ab (00:18:4d:09:98:ab) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.105 (165.227.249.105), Dst: 165.227.249.150 (165.227.249.150) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 384 Identification: 0x8b61 (35681) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: ESP (0x32) Header checksum: 0xaf23 [correct] Good: True Bad : False Source: 165.227.249.105 (165.227.249.105) Destination: 165.227.249.150 (165.227.249.150) Encapsulating Security Payload SPI: 0x6db82c72 Sequence: 1 Data (356 bytes) 0000 00 0c 29 96 e1 fa 00 18 4d 09 98 ab 08 00 45 00 ..).....M.....E. 0010 01 80 8b 61 00 00 40 32 af 23 a5 e3 f9 69 a5 e3 ...a..@2.#...i.. 0020 f9 96 6d b8 2c 72 00 00 00 01 18 36 26 8e 3c 92 ..m.,r.....6&.<. 0030 ec c7 a9 60 47 9a ed 62 1d 9d d8 dd 39 7c 50 64 ...`G..b....9|Pd 0040 66 61 01 15 be 4d 80 c4 56 a4 50 33 69 d4 9d 10 fa...M..V.P3i... 0050 08 e5 75 8b 31 41 96 41 85 3b 32 dd d9 3e 70 af ..u.1A.A.;2..>p. 0060 16 d6 89 99 06 2a 8b a7 82 38 54 66 22 63 7f c9 .....*...8Tf"c.. 0070 ee 62 3b 5d 75 20 5b ec 79 63 36 61 4e 80 e5 03 .b;]u [.yc6aN... 0080 cb c7 43 c0 25 40 43 54 b2 85 0a 07 a0 50 69 be ..C.%@CT.....Pi. 0090 a6 9f d4 8d 84 71 16 ba d8 91 96 64 36 f3 6c 2c .....q.....d6.l, 00a0 c9 bc cb 87 b3 9b f7 a3 87 cc aa 33 e5 98 92 b8 ...........3.... 00b0 92 32 8e f0 bb 53 8d 87 74 80 81 80 61 03 4a 5e .2...S..t...a.J^ 00c0 4e 22 94 5d ae 60 da 44 fd 97 79 cb b5 1d ad 7a N".].`.D..y....z 00d0 d4 43 c1 34 fd 92 de 18 bb 12 d6 f6 91 58 32 4b .C.4.........X2K 00e0 57 70 18 a9 ae e6 fd 2d 8d d2 cc 0b 53 44 5d 82 Wp.....-....SD]. 00f0 77 a4 9b eb 67 fc 88 6e cf a0 61 e3 0d 6e f7 cf w...g..n..a..n.. 0100 c1 e7 bc cb 3a a7 dd 58 46 d7 78 1d 73 90 df 9e ....:..XF.x.s... 0110 bc 46 20 91 35 f4 59 6b 62 16 47 ca 7b cf fb a4 .F .5.Ykb.G.{... 0120 5e 4f 43 3c bd 6f 35 5a ec df 5d 54 34 11 07 ed ^OC<.o5Z..]T4... 0130 65 f9 95 03 a7 a4 4d 1d 0f fd 88 07 0a 92 dd 04 e.....M......... 0140 a4 fa 36 0f d9 bc 2c 7e 40 43 d8 13 35 37 59 25 ..6...,~@C..57Y% 0150 c9 e7 4d 83 1f 5d d6 5c d8 83 d7 4f 9c e4 10 38 ..M..].\...O...8 0160 2f ff a2 e2 6e 85 7c 3b 1f 2c 74 06 d2 33 64 95 /...n.|;.,t..3d. 0170 a0 1f 40 96 3b 06 86 75 cd d5 2c 98 c8 77 bc f4 ..@.;..u..,..w.. 0180 59 73 15 d1 13 79 15 35 2f 10 64 22 60 0d Ys...y.5/.d"`.