Frame 1 (222 bytes on wire, 222 bytes captured) Arrival Time: Aug 13, 2006 12:37:47.299015000 Time delta from previous packet: 0.000000000 seconds Time since reference or first frame: 0.000000000 seconds Frame Number: 1 Packet Length: 222 bytes Capture Length: 222 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa), Dst: 00:0f:b5:ca:72:27 (00:0f:b5:ca:72:27) Destination: 00:0f:b5:ca:72:27 (00:0f:b5:ca:72:27) Source: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.150 (165.227.249.150), Dst: 165.227.249.109 (165.227.249.109) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 208 Identification: 0x027c (636) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: UDP (0x11) Header checksum: 0xf8d5 [correct] Good: True Bad : False Source: 165.227.249.150 (165.227.249.150) Destination: 165.227.249.109 (165.227.249.109) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 188 Checksum: 0x3ee8 [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0xA8FF4E32827D1E09 Responder cookie: 0x0000000000000000 Next payload: Security Association (1) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 180 Security Association payload Next payload: Vendor ID (13) Length: 52 Domain of interpretation: IPSEC (1) Situation: IDENTITY (1) Proposal payload # 1 Next payload: NONE (0) Length: 40 Proposal number: 1 Protocol ID: ISAKMP (1) SPI size: 0 Number of transforms: 1 Transform payload # 1 Next payload: NONE (0) Length: 32 Transform number: 1 Transform ID: KEY_IKE (1) Encryption-Algorithm (1): 3DES-CBC (5) Hash-Algorithm (2): SHA (2) Group-Description (4): Alternate 1024-bit MODP group (2) Authentication-Method (3): PSK (1) Life-Type (11): Seconds (1) Life-Duration (12): Duration-Value (28800) Vendor ID payload Next payload: Vendor ID (13) Length: 20 Vendor ID: unknown vendor ID: 0x4A131C81070358455C5728F20E95452F Vendor ID payload Next payload: Vendor ID (13) Length: 20 Vendor ID: draft-ietf-ipsec-nat-t-ike-03 Vendor ID payload Next payload: Vendor ID (13) Length: 20 Vendor ID: draft-ietf-ipsec-nat-t-ike-02 Vendor ID payload Next payload: Vendor ID (13) Length: 20 Vendor ID: draft-ietf-ipsec-nat-t-ike-00 Vendor ID payload Next payload: NONE (0) Length: 20 Vendor ID: RFC 3706 Detecting Dead IKE Peers (DPD) 0000 00 0f b5 ca 72 27 00 0c 29 96 e1 fa 08 00 45 00 ....r'..).....E. 0010 00 d0 02 7c 00 00 80 11 f8 d5 a5 e3 f9 96 a5 e3 ...|............ 0020 f9 6d 01 f4 01 f4 00 bc 3e e8 a8 ff 4e 32 82 7d .m......>...N2.} 0030 1e 09 00 00 00 00 00 00 00 00 01 10 02 00 00 00 ................ 0040 00 00 00 00 00 b4 0d 00 00 34 00 00 00 01 00 00 .........4...... 0050 00 01 00 00 00 28 01 01 00 01 00 00 00 20 01 01 .....(....... .. 0060 00 00 80 01 00 05 80 02 00 02 80 04 00 02 80 03 ................ 0070 00 01 80 0b 00 01 80 0c 70 80 0d 00 00 14 4a 13 ........p.....J. 0080 1c 81 07 03 58 45 5c 57 28 f2 0e 95 45 2f 0d 00 ....XE\W(...E/.. 0090 00 14 7d 94 19 a6 53 10 ca 6f 2c 17 9d 92 15 52 ..}...S..o,....R 00a0 9d 56 0d 00 00 14 90 cb 80 91 3e bb 69 6e 08 63 .V........>.in.c 00b0 81 b5 ec 42 7b 1f 0d 00 00 14 44 85 15 2d 18 b6 ...B{.....D..-.. 00c0 bb cd 0b e8 a8 46 95 79 dd cc 00 00 00 14 af ca .....F.y........ 00d0 d7 13 68 a1 f1 c9 6b 86 96 fc 77 57 01 00 ..h...k...wW.. Frame 2 (182 bytes on wire, 182 bytes captured) Arrival Time: Aug 13, 2006 12:37:47.330217000 Time delta from previous packet: 0.031202000 seconds Time since reference or first frame: 0.031202000 seconds Frame Number: 2 Packet Length: 182 bytes Capture Length: 182 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:0f:b5:ca:72:27 (00:0f:b5:ca:72:27), Dst: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa) Destination: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa) Source: 00:0f:b5:ca:72:27 (00:0f:b5:ca:72:27) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.109 (165.227.249.109), Dst: 165.227.249.150 (165.227.249.150) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 168 Identification: 0x02d2 (722) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0x38a8 [correct] Good: True Bad : False Source: 165.227.249.109 (165.227.249.109) Destination: 165.227.249.150 (165.227.249.150) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 148 Checksum: 0x074c [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0xA8FF4E32827D1E09 Responder cookie: 0x6684CC8FCB80E8E0 Next payload: Security Association (1) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 140 Security Association payload Next payload: Vendor ID (13) Length: 52 Domain of interpretation: IPSEC (1) Situation: IDENTITY (1) Proposal payload # 1 Next payload: NONE (0) Length: 40 Proposal number: 1 Protocol ID: ISAKMP (1) SPI size: 0 Number of transforms: 1 Transform payload # 1 Next payload: NONE (0) Length: 32 Transform number: 1 Transform ID: KEY_IKE (1) Encryption-Algorithm (1): 3DES-CBC (5) Hash-Algorithm (2): SHA (2) Group-Description (4): Alternate 1024-bit MODP group (2) Authentication-Method (3): PSK (1) Life-Type (11): Seconds (1) Life-Duration (12): Duration-Value (28800) Vendor ID payload Next payload: Vendor ID (13) Length: 20 Vendor ID: draft-ietf-ipsec-nat-t-ike-02 Vendor ID payload Next payload: Vendor ID (13) Length: 20 Vendor ID: RFC 3706 Detecting Dead IKE Peers (DPD) Vendor ID payload Next payload: NONE (0) Length: 20 Vendor ID: unknown vendor ID: 0x648982785BEDBDD66A6DD356F0E160FD 0000 00 0c 29 96 e1 fa 00 0f b5 ca 72 27 08 00 45 00 ..).......r'..E. 0010 00 a8 02 d2 00 00 40 11 38 a8 a5 e3 f9 6d a5 e3 ......@.8....m.. 0020 f9 96 01 f4 01 f4 00 94 07 4c a8 ff 4e 32 82 7d .........L..N2.} 0030 1e 09 66 84 cc 8f cb 80 e8 e0 01 10 02 00 00 00 ..f............. 0040 00 00 00 00 00 8c 0d 00 00 34 00 00 00 01 00 00 .........4...... 0050 00 01 00 00 00 28 01 01 00 01 00 00 00 20 01 01 .....(....... .. 0060 00 00 80 01 00 05 80 02 00 02 80 04 00 02 80 03 ................ 0070 00 01 80 0b 00 01 80 0c 70 80 0d 00 00 14 90 cb ........p....... 0080 80 91 3e bb 69 6e 08 63 81 b5 ec 42 7b 1f 0d 00 ..>.in.c...B{... 0090 00 14 af ca d7 13 68 a1 f1 c9 6b 86 96 fc 77 57 ......h...k...wW 00a0 01 00 00 00 00 14 64 89 82 78 5b ed bd d6 6a 6d ......d..x[...jm 00b0 d3 56 f0 e1 60 fd .V..`. Frame 3 (270 bytes on wire, 270 bytes captured) Arrival Time: Aug 13, 2006 12:37:47.351426000 Time delta from previous packet: 0.021209000 seconds Time since reference or first frame: 0.052411000 seconds Frame Number: 3 Packet Length: 270 bytes Capture Length: 270 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa), Dst: 00:0f:b5:ca:72:27 (00:0f:b5:ca:72:27) Destination: 00:0f:b5:ca:72:27 (00:0f:b5:ca:72:27) Source: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.150 (165.227.249.150), Dst: 165.227.249.109 (165.227.249.109) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 256 Identification: 0x027d (637) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: UDP (0x11) Header checksum: 0xf8a4 [correct] Good: True Bad : False Source: 165.227.249.150 (165.227.249.150) Destination: 165.227.249.109 (165.227.249.109) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 236 Checksum: 0xdf96 [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0xA8FF4E32827D1E09 Responder cookie: 0x6684CC8FCB80E8E0 Next payload: Key Exchange (4) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 228 Key Exchange payload Next payload: Nonce (10) Length: 132 Key Exchange Data Nonce payload Next payload: NAT-D (draft-ietf-ipsec-nat-t-ike-01 to 03) (130) Length: 20 Nonce Data NAT-D (draft-ietf-ipsec-nat-t-ike-01 to 03) payload Next payload: NAT-D (draft-ietf-ipsec-nat-t-ike-01 to 03) (130) Length: 24 Hash of address and port: 0C27A57A0475E25A4806A62B5EB837BE273752AA NAT-D (draft-ietf-ipsec-nat-t-ike-01 to 03) payload Next payload: NONE (0) Length: 24 Hash of address and port: FAE9FE338FF7BAD24B2773DDCD854B918B068010 0000 00 0f b5 ca 72 27 00 0c 29 96 e1 fa 08 00 45 00 ....r'..).....E. 0010 01 00 02 7d 00 00 80 11 f8 a4 a5 e3 f9 96 a5 e3 ...}............ 0020 f9 6d 01 f4 01 f4 00 ec df 96 a8 ff 4e 32 82 7d .m..........N2.} 0030 1e 09 66 84 cc 8f cb 80 e8 e0 04 10 02 00 00 00 ..f............. 0040 00 00 00 00 00 e4 0a 00 00 84 48 12 e2 de 15 17 ..........H..... 0050 a6 b2 b1 8c bf 76 34 9e e8 66 05 18 c2 2b 8c b3 .....v4..f...+.. 0060 cf 8c b4 27 e5 45 c0 06 66 7b e4 e7 f1 15 bd 8c ...'.E..f{...... 0070 78 7e e4 8f 94 f0 74 fa fe 19 a8 f7 93 4c 0e 90 x~....t......L.. 0080 d6 5d 3f 26 92 6f 9e be 9e cc 9d 35 14 84 fd f8 .]?&.o.....5.... 0090 70 f6 22 92 ab 7f ee 52 ab 5b 54 f0 0d 51 eb 92 p."....R.[T..Q.. 00a0 23 35 7f 93 71 dd de 17 a3 18 0b aa 2c f8 56 4b #5..q.......,.VK 00b0 83 7d 98 e5 28 6b 2a 8a 32 88 11 e7 e5 9e 3d c2 .}..(k*.2.....=. 00c0 c9 07 89 0d 85 e6 21 24 25 98 82 00 00 14 e4 56 ......!$%......V 00d0 5e 6a c4 9b b7 41 02 2b 48 ba 53 8c b9 ad 82 00 ^j...A.+H.S..... 00e0 00 18 0c 27 a5 7a 04 75 e2 5a 48 06 a6 2b 5e b8 ...'.z.u.ZH..+^. 00f0 37 be 27 37 52 aa 00 00 00 18 fa e9 fe 33 8f f7 7.'7R........3.. 0100 ba d2 4b 27 73 dd cd 85 4b 91 8b 06 80 10 ..K's...K..... Frame 4 (262 bytes on wire, 262 bytes captured) Arrival Time: Aug 13, 2006 12:37:47.876722000 Time delta from previous packet: 0.525296000 seconds Time since reference or first frame: 0.577707000 seconds Frame Number: 4 Packet Length: 262 bytes Capture Length: 262 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:0f:b5:ca:72:27 (00:0f:b5:ca:72:27), Dst: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa) Destination: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa) Source: 00:0f:b5:ca:72:27 (00:0f:b5:ca:72:27) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.109 (165.227.249.109), Dst: 165.227.249.150 (165.227.249.150) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 248 Identification: 0x02d3 (723) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0x3857 [correct] Good: True Bad : False Source: 165.227.249.109 (165.227.249.109) Destination: 165.227.249.150 (165.227.249.150) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 228 Checksum: 0x154b [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0xA8FF4E32827D1E09 Responder cookie: 0x6684CC8FCB80E8E0 Next payload: Key Exchange (4) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 220 Key Exchange payload Next payload: Nonce (10) Length: 132 Key Exchange Data Nonce payload Next payload: NAT-D (draft-ietf-ipsec-nat-t-ike-01 to 03) (130) Length: 12 Nonce Data NAT-D (draft-ietf-ipsec-nat-t-ike-01 to 03) payload Next payload: NAT-D (draft-ietf-ipsec-nat-t-ike-01 to 03) (130) Length: 24 Hash of address and port: FAE9FE338FF7BAD24B2773DDCD854B918B068010 NAT-D (draft-ietf-ipsec-nat-t-ike-01 to 03) payload Next payload: NONE (0) Length: 24 Hash of address and port: 0C27A57A0475E25A4806A62B5EB837BE273752AA 0000 00 0c 29 96 e1 fa 00 0f b5 ca 72 27 08 00 45 00 ..).......r'..E. 0010 00 f8 02 d3 00 00 40 11 38 57 a5 e3 f9 6d a5 e3 ......@.8W...m.. 0020 f9 96 01 f4 01 f4 00 e4 15 4b a8 ff 4e 32 82 7d .........K..N2.} 0030 1e 09 66 84 cc 8f cb 80 e8 e0 04 10 02 00 00 00 ..f............. 0040 00 00 00 00 00 dc 0a 00 00 84 16 e9 44 9d f9 c0 ............D... 0050 d4 5d 88 99 0b b0 c5 e3 2e ae a6 ac 6e 5e cf 18 .]..........n^.. 0060 19 5b c7 df b8 53 bb 71 98 4e 5f dd ce 4d b8 35 .[...S.q.N_..M.5 0070 e7 ae 39 72 a0 d3 c0 3e 01 aa 7d 81 51 12 31 2b ..9r...>..}.Q.1+ 0080 20 e9 b3 1a 6f ff 38 06 bf 3f a2 e9 9b 1e b2 fc ...o.8..?...... 0090 52 82 82 e6 15 34 6a db 7a dc b4 3c b2 18 9c 55 R....4j.z..<...U 00a0 d2 b6 e4 5e c7 a6 32 92 bd bd b1 b0 dd 06 22 b7 ...^..2.......". 00b0 c6 03 85 6f 07 73 96 56 b4 8f 52 d1 ef fa 30 b1 ...o.s.V..R...0. 00c0 76 22 9f db 42 a8 79 c2 26 e2 82 00 00 0c d1 c8 v"..B.y.&....... 00d0 03 8a 2f 9e 35 f5 82 00 00 18 fa e9 fe 33 8f f7 ../.5........3.. 00e0 ba d2 4b 27 73 dd cd 85 4b 91 8b 06 80 10 00 00 ..K's...K....... 00f0 00 18 0c 27 a5 7a 04 75 e2 5a 48 06 a6 2b 5e b8 ...'.z.u.ZH..+^. 0100 37 be 27 37 52 aa 7.'7R. Frame 5 (142 bytes on wire, 142 bytes captured) Arrival Time: Aug 13, 2006 12:37:47.939328000 Time delta from previous packet: 0.062606000 seconds Time since reference or first frame: 0.640313000 seconds Frame Number: 5 Packet Length: 142 bytes Capture Length: 142 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa), Dst: 00:0f:b5:ca:72:27 (00:0f:b5:ca:72:27) Destination: 00:0f:b5:ca:72:27 (00:0f:b5:ca:72:27) Source: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.150 (165.227.249.150), Dst: 165.227.249.109 (165.227.249.109) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 128 Identification: 0x027e (638) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: UDP (0x11) Header checksum: 0xf923 [correct] Good: True Bad : False Source: 165.227.249.150 (165.227.249.150) Destination: 165.227.249.109 (165.227.249.109) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 108 Checksum: 0x3ece [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0xA8FF4E32827D1E09 Responder cookie: 0x6684CC8FCB80E8E0 Next payload: Identification (5) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 100 Encrypted payload (72 bytes) 0000 00 0f b5 ca 72 27 00 0c 29 96 e1 fa 08 00 45 00 ....r'..).....E. 0010 00 80 02 7e 00 00 80 11 f9 23 a5 e3 f9 96 a5 e3 ...~.....#...... 0020 f9 6d 01 f4 01 f4 00 6c 3e ce a8 ff 4e 32 82 7d .m.....l>...N2.} 0030 1e 09 66 84 cc 8f cb 80 e8 e0 05 10 02 01 00 00 ..f............. 0040 00 00 00 00 00 64 f3 5c 76 e7 71 ab 6c 07 ab 2d .....d.\v.q.l..- 0050 60 5d 87 f9 27 a4 16 fc 6b e0 14 83 a3 24 fd 93 `]..'...k....$.. 0060 a2 c6 75 34 0e f8 3d 17 e5 eb d6 dc 01 38 bc 5c ..u4..=......8.\ 0070 94 5b 67 b9 3a 38 6b d5 b8 e2 00 47 62 aa 76 d7 .[g.:8k....Gb.v. 0080 39 c4 a0 70 7e 72 4b 2e 4f cf e1 0e d3 ce 9..p~rK.O..... Frame 6 (134 bytes on wire, 134 bytes captured) Arrival Time: Aug 13, 2006 12:37:48.522290000 Time delta from previous packet: 0.582962000 seconds Time since reference or first frame: 1.223275000 seconds Frame Number: 6 Packet Length: 134 bytes Capture Length: 134 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:0f:b5:ca:72:27 (00:0f:b5:ca:72:27), Dst: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa) Destination: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa) Source: 00:0f:b5:ca:72:27 (00:0f:b5:ca:72:27) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.109 (165.227.249.109), Dst: 165.227.249.150 (165.227.249.150) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 120 Identification: 0x02d4 (724) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0x38d6 [correct] Good: True Bad : False Source: 165.227.249.109 (165.227.249.109) Destination: 165.227.249.150 (165.227.249.150) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 100 Checksum: 0xa381 [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0xA8FF4E32827D1E09 Responder cookie: 0x6684CC8FCB80E8E0 Next payload: Identification (5) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 92 Encrypted payload (64 bytes) 0000 00 0c 29 96 e1 fa 00 0f b5 ca 72 27 08 00 45 00 ..).......r'..E. 0010 00 78 02 d4 00 00 40 11 38 d6 a5 e3 f9 6d a5 e3 .x....@.8....m.. 0020 f9 96 01 f4 01 f4 00 64 a3 81 a8 ff 4e 32 82 7d .......d....N2.} 0030 1e 09 66 84 cc 8f cb 80 e8 e0 05 10 02 01 00 00 ..f............. 0040 00 00 00 00 00 5c a9 dc ce 61 57 f5 bd ea db 4e .....\...aW....N 0050 9f ed ab 37 ae bd a7 19 39 c2 48 83 e1 fb 5a 53 ...7....9.H...ZS 0060 3e 7c 2a 20 c3 3d de 90 1d ba 0b ab 4c c9 3d a1 >|* .=......L.=. 0070 2d f8 87 2f 49 ab 12 a8 d5 f9 75 a9 5c 48 aa 55 -../I.....u.\H.U 0080 47 11 e5 d3 7a 7a G...zz Frame 7 (334 bytes on wire, 334 bytes captured) Arrival Time: Aug 13, 2006 12:37:48.556849000 Time delta from previous packet: 0.034559000 seconds Time since reference or first frame: 1.257834000 seconds Frame Number: 7 Packet Length: 334 bytes Capture Length: 334 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa), Dst: 00:0f:b5:ca:72:27 (00:0f:b5:ca:72:27) Destination: 00:0f:b5:ca:72:27 (00:0f:b5:ca:72:27) Source: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.150 (165.227.249.150), Dst: 165.227.249.109 (165.227.249.109) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 320 Identification: 0x027f (639) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: UDP (0x11) Header checksum: 0xf862 [correct] Good: True Bad : False Source: 165.227.249.150 (165.227.249.150) Destination: 165.227.249.109 (165.227.249.109) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 300 Checksum: 0x2746 [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0xA8FF4E32827D1E09 Responder cookie: 0x6684CC8FCB80E8E0 Next payload: Hash (8) Version: 1.0 Exchange type: Quick Mode (32) Flags .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0xDA85FF7E Length: 292 Encrypted payload (264 bytes) 0000 00 0f b5 ca 72 27 00 0c 29 96 e1 fa 08 00 45 00 ....r'..).....E. 0010 01 40 02 7f 00 00 80 11 f8 62 a5 e3 f9 96 a5 e3 .@.......b...... 0020 f9 6d 01 f4 01 f4 01 2c 27 46 a8 ff 4e 32 82 7d .m.....,'F..N2.} 0030 1e 09 66 84 cc 8f cb 80 e8 e0 08 10 20 01 da 85 ..f......... ... 0040 ff 7e 00 00 01 24 7a 2b d1 b7 ec 56 03 5b f2 b5 .~...$z+...V.[.. 0050 01 f9 03 b7 93 ed 7f 57 5e 4a f9 21 91 a8 77 a6 .......W^J.!..w. 0060 e0 6c f3 d6 b7 5d 38 93 32 b3 39 01 b0 4b 21 45 .l...]8.2.9..K!E 0070 1b 18 7d 3a ea d2 97 98 e9 34 b8 30 40 11 e1 6a ..}:.....4.0@..j 0080 39 6e 9d eb 0e 14 79 eb 56 29 be 7a 89 eb 5f 8b 9n....y.V).z.._. 0090 a2 62 21 37 8b 76 a3 62 49 f8 3c 2a d2 46 ed c0 .b!7.v.bI.<*.F.. 00a0 16 0a 39 8d db 1c 6e c9 39 73 14 c1 60 02 ea 15 ..9...n.9s..`... 00b0 ea 2d 7e cf 78 cd f6 7d e4 7b 9d 1c 38 90 86 b7 .-~.x..}.{..8... 00c0 f0 ca 07 c4 60 67 87 29 8a 6e 41 22 de f3 29 5b ....`g.).nA"..)[ 00d0 1f 4c 7c 7e 0d c8 14 28 bb cc be c2 bc bc ca b5 .L|~...(........ 00e0 bb a0 cd 8e 1e 6e fb e0 1c 06 82 6a 45 96 88 21 .....n.....jE..! 00f0 00 29 67 c2 90 3b 4c 03 c9 8c 64 d3 e6 f6 93 80 .)g..;L...d..... 0100 15 7e c9 bd 95 8f d1 05 76 70 ec 3a 80 ad 66 ee .~......vp.:..f. 0110 8e 01 df 45 13 10 b3 b1 78 79 58 2b ba 89 31 20 ...E....xyX+..1 0120 06 37 4d 1a 5b fb 0c 5d c0 2b d5 c7 0a 88 a8 5a .7M.[..].+.....Z 0130 07 f9 8d c0 2d 18 18 c4 97 8b cb 36 56 10 67 e3 ....-......6V.g. 0140 a9 4a 2f 54 50 6c b1 f3 71 47 37 15 34 1c .J/TPl..qG7.4. Frame 8 (318 bytes on wire, 318 bytes captured) Arrival Time: Aug 13, 2006 12:37:49.050718000 Time delta from previous packet: 0.493869000 seconds Time since reference or first frame: 1.751703000 seconds Frame Number: 8 Packet Length: 318 bytes Capture Length: 318 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:0f:b5:ca:72:27 (00:0f:b5:ca:72:27), Dst: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa) Destination: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa) Source: 00:0f:b5:ca:72:27 (00:0f:b5:ca:72:27) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.109 (165.227.249.109), Dst: 165.227.249.150 (165.227.249.150) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 304 Identification: 0x02d9 (729) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0x3819 [correct] Good: True Bad : False Source: 165.227.249.109 (165.227.249.109) Destination: 165.227.249.150 (165.227.249.150) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 284 Checksum: 0x021f [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0xA8FF4E32827D1E09 Responder cookie: 0x6684CC8FCB80E8E0 Next payload: Hash (8) Version: 1.0 Exchange type: Quick Mode (32) Flags .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0xDA85FF7E Length: 276 Encrypted payload (248 bytes) 0000 00 0c 29 96 e1 fa 00 0f b5 ca 72 27 08 00 45 00 ..).......r'..E. 0010 01 30 02 d9 00 00 40 11 38 19 a5 e3 f9 6d a5 e3 .0....@.8....m.. 0020 f9 96 01 f4 01 f4 01 1c 02 1f a8 ff 4e 32 82 7d ............N2.} 0030 1e 09 66 84 cc 8f cb 80 e8 e0 08 10 20 01 da 85 ..f......... ... 0040 ff 7e 00 00 01 14 b9 1e 04 93 d9 7b ab b7 72 b4 .~.........{..r. 0050 ef f9 85 9e 18 cb 7f 4b 9d a5 66 70 98 87 d3 fb .......K..fp.... 0060 a4 1c 77 28 03 38 fe f7 3e 60 f6 13 da d1 92 50 ..w(.8..>`.....P 0070 e4 ce b0 eb 35 2a a7 a9 6c d2 51 e0 91 cf 23 ba ....5*..l.Q...#. 0080 23 e2 29 ee b4 ec e9 ca 36 f5 88 8b 6f b1 f0 ac #.).....6...o... 0090 bd 9c 98 d4 38 4d 15 29 26 33 dc 71 4b 64 c1 81 ....8M.)&3.qKd.. 00a0 e7 9f c4 83 40 94 0f 67 60 6c af ca 43 87 f3 bb ....@..g`l..C... 00b0 e2 81 46 fa c3 62 c4 2a 18 6d 47 67 66 2e b6 27 ..F..b.*.mGgf..' 00c0 ec f9 0f 97 c2 79 58 a6 92 d8 9e f7 d9 5f 2e f5 .....yX......_.. 00d0 11 39 db 42 67 34 86 4c 9f c1 ee dd 33 e7 7c b7 .9.Bg4.L....3.|. 00e0 97 f2 c9 97 90 59 b9 4f be a7 c0 a9 af 21 6b ef .....Y.O.....!k. 00f0 96 3a 99 8a 5d c9 cc 87 89 40 d3 fa 0c 18 ef c8 .:..]....@...... 0100 58 3c de 00 7f ed a1 24 40 53 64 bb 55 0e 3c 52 X<.....$@Sd.U......7rR 0080 41 ad 51 b9 57 05 a0 2a f9 99 5e d4 43 c8 dc d7 A.Q.W..*..^.C... 0090 c1 0a 7b 6e 40 a7 74 36 15 d9 9a 88 62 43 8a 37 ..{n@.t6....bC.7 00a0 0e c8 42 1d b9 cd 07 1a 58 3d 03 15 a7 f7 a3 98 ..B.....X=...... 00b0 45 fe cc 67 b1 c6 a9 94 8b da 00 68 e0 78 b8 21 E..g.......h.x.! 00c0 89 ef 0c b0 56 48 cf d6 a7 cb 27 a4 c4 5b b5 e3 ....VH....'..[.. 00d0 b4 0d f2 83 45 d2 b3 37 6c 82 66 69 a3 a5 a7 35 ....E..7l.fi...5 00e0 ab 65 ec 56 19 ae 38 3f f0 84 94 3e cf 9a 42 d5 .e.V..8?...>..B. 00f0 5d 83 be 64 b8 30 88 ce a7 c9 18 54 ea 31 d4 32 ]..d.0.....T.1.2 0100 72 9c 30 f3 b5 bd af aa bd df 70 7d 89 32 ba fb r.0.......p}.2.. 0110 58 78 10 e9 29 f2 7d 6a e6 fd 1b ec c1 3f 07 ed Xx..).}j.....?.. 0120 03 48 9d 52 f6 75 fd 8a e9 e2 af 4d 61 90 58 82 .H.R.u.....Ma.X. 0130 c2 d3 ae 28 a4 2b 62 ef d3 9e e2 fd 98 e7 8c 8d ...(.+b......... 0140 46 45 69 0e 5a a7 64 21 b0 3b dc 2a 44 66 10 44 FEi.Z.d!.;.*Df.D 0150 bb 0b c9 17 7c 42 00 c5 9e 5f 6b dc cb fd 67 0f ....|B..._k...g. 0160 7e 64 2d ce 38 24 d1 96 b8 c9 a3 1e 4c cc ed ee ~d-.8$......L... 0170 01 7c 4f ac 2a 90 c9 06 3c 96 01 37 0b 77 05 53 .|O.*...<..7.w.S 0180 78 67 ae c8 68 c8 82 ee b9 ee b0 8a e8 c4 xg..h.........