Frame 1 (226 bytes on wire, 226 bytes captured) Arrival Time: Aug 15, 2006 11:37:29.119432000 Time delta from previous packet: 0.000000000 seconds Time since reference or first frame: 0.000000000 seconds Frame Number: 1 Packet Length: 226 bytes Capture Length: 226 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa), Dst: 00:80:c8:b9:b1:b8 (00:80:c8:b9:b1:b8) Destination: 00:80:c8:b9:b1:b8 (00:80:c8:b9:b1:b8) Source: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa) Type: IP (0x0800) Frame check sequence: 0x6510c66a [correct] Internet Protocol, Src: 165.227.249.150 (165.227.249.150), Dst: 165.227.249.111 (165.227.249.111) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 208 Identification: 0x01a3 (419) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: UDP (0x11) Header checksum: 0xf9ac [correct] Good: True Bad : False Source: 165.227.249.150 (165.227.249.150) Destination: 165.227.249.111 (165.227.249.111) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 188 Checksum: 0xb3bd [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0x0FF09E2E6B1409AE Responder cookie: 0x0000000000000000 Next payload: Security Association (1) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 180 Security Association payload Next payload: Vendor ID (13) Length: 52 Domain of interpretation: IPSEC (1) Situation: IDENTITY (1) Proposal payload # 1 Next payload: NONE (0) Length: 40 Proposal number: 1 Protocol ID: ISAKMP (1) SPI size: 0 Number of transforms: 1 Transform payload # 1 Next payload: NONE (0) Length: 32 Transform number: 1 Transform ID: KEY_IKE (1) Encryption-Algorithm (1): 3DES-CBC (5) Hash-Algorithm (2): SHA (2) Group-Description (4): Alternate 1024-bit MODP group (2) Authentication-Method (3): PSK (1) Life-Type (11): Seconds (1) Life-Duration (12): Duration-Value (28800) Vendor ID payload Next payload: Vendor ID (13) Length: 20 Vendor ID: unknown vendor ID: 0x4A131C81070358455C5728F20E95452F Vendor ID payload Next payload: Vendor ID (13) Length: 20 Vendor ID: draft-ietf-ipsec-nat-t-ike-03 Vendor ID payload Next payload: Vendor ID (13) Length: 20 Vendor ID: draft-ietf-ipsec-nat-t-ike-02 Vendor ID payload Next payload: Vendor ID (13) Length: 20 Vendor ID: draft-ietf-ipsec-nat-t-ike-00 Vendor ID payload Next payload: NONE (0) Length: 20 Vendor ID: RFC 3706 Detecting Dead IKE Peers (DPD) 0000 00 80 c8 b9 b1 b8 00 0c 29 96 e1 fa 08 00 45 00 ........).....E. 0010 00 d0 01 a3 00 00 80 11 f9 ac a5 e3 f9 96 a5 e3 ................ 0020 f9 6f 01 f4 01 f4 00 bc b3 bd 0f f0 9e 2e 6b 14 .o............k. 0030 09 ae 00 00 00 00 00 00 00 00 01 10 02 00 00 00 ................ 0040 00 00 00 00 00 b4 0d 00 00 34 00 00 00 01 00 00 .........4...... 0050 00 01 00 00 00 28 01 01 00 01 00 00 00 20 01 01 .....(....... .. 0060 00 00 80 01 00 05 80 02 00 02 80 04 00 02 80 03 ................ 0070 00 01 80 0b 00 01 80 0c 70 80 0d 00 00 14 4a 13 ........p.....J. 0080 1c 81 07 03 58 45 5c 57 28 f2 0e 95 45 2f 0d 00 ....XE\W(...E/.. 0090 00 14 7d 94 19 a6 53 10 ca 6f 2c 17 9d 92 15 52 ..}...S..o,....R 00a0 9d 56 0d 00 00 14 90 cb 80 91 3e bb 69 6e 08 63 .V........>.in.c 00b0 81 b5 ec 42 7b 1f 0d 00 00 14 44 85 15 2d 18 b6 ...B{.....D..-.. 00c0 bb cd 0b e8 a8 46 95 79 dd cc 00 00 00 14 af ca .....F.y........ 00d0 d7 13 68 a1 f1 c9 6b 86 96 fc 77 57 01 00 65 10 ..h...k...wW..e. 00e0 c6 6a .j Frame 2 (266 bytes on wire, 266 bytes captured) Arrival Time: Aug 15, 2006 11:37:29.121154000 Time delta from previous packet: 0.001722000 seconds Time since reference or first frame: 0.001722000 seconds Frame Number: 2 Packet Length: 266 bytes Capture Length: 266 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:80:c8:b9:b1:b8 (00:80:c8:b9:b1:b8), Dst: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa) Destination: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa) Source: 00:80:c8:b9:b1:b8 (00:80:c8:b9:b1:b8) Type: IP (0x0800) Frame check sequence: 0x101253c1 [correct] Internet Protocol, Src: 165.227.249.111 (165.227.249.111), Dst: 165.227.249.150 (165.227.249.150) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 248 Identification: 0x83c9 (33737) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xb75e [correct] Good: True Bad : False Source: 165.227.249.111 (165.227.249.111) Destination: 165.227.249.150 (165.227.249.150) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 228 Checksum: 0x0000 (none) Internet Security Association and Key Management Protocol Initiator cookie: 0x0FF09E2E6B1409AE Responder cookie: 0x3EDF56E798035FC4 Next payload: Security Association (1) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 220 Security Association payload Next payload: Vendor ID (13) Length: 52 Domain of interpretation: IPSEC (1) Situation: IDENTITY (1) Proposal payload # 1 Next payload: NONE (0) Length: 40 Proposal number: 1 Protocol ID: ISAKMP (1) SPI size: 0 Number of transforms: 1 Transform payload # 1 Next payload: NONE (0) Length: 32 Transform number: 1 Transform ID: KEY_IKE (1) Encryption-Algorithm (1): 3DES-CBC (5) Hash-Algorithm (2): SHA (2) Group-Description (4): Alternate 1024-bit MODP group (2) Authentication-Method (3): PSK (1) Life-Type (11): Seconds (1) Life-Duration (12): Duration-Value (28800) Vendor ID payload Next payload: Vendor ID (13) Length: 20 Vendor ID: unknown vendor ID: 0x5DE9BC4C3560AA16CB2DF25E7950F160 Vendor ID payload Next payload: Vendor ID (13) Length: 20 Vendor ID: draft-stenberg-ipsec-nat-traversal-01 Vendor ID payload Next payload: Vendor ID (13) Length: 20 Vendor ID: draft-stenberg-ipsec-nat-traversal-02 Vendor ID payload Next payload: Vendor ID (13) Length: 20 Vendor ID: draft-ietf-ipsec-nat-t-ike-00 Vendor ID payload Next payload: Vendor ID (13) Length: 20 Vendor ID: draft-ietf-ipsec-nat-t-ike-02 Vendor ID payload Next payload: Vendor ID (13) Length: 20 Vendor ID: draft-ietf-ipsec-nat-t-ike-02 Vendor ID payload Next payload: NONE (0) Length: 20 Vendor ID: draft-ietf-ipsec-nat-t-ike-03 0000 00 0c 29 96 e1 fa 00 80 c8 b9 b1 b8 08 00 45 00 ..)...........E. 0010 00 f8 83 c9 00 00 40 11 b7 5e a5 e3 f9 6f a5 e3 ......@..^...o.. 0020 f9 96 01 f4 01 f4 00 e4 00 00 0f f0 9e 2e 6b 14 ..............k. 0030 09 ae 3e df 56 e7 98 03 5f c4 01 10 02 00 00 00 ..>.V..._....... 0040 00 00 00 00 00 dc 0d 00 00 34 00 00 00 01 00 00 .........4...... 0050 00 01 00 00 00 28 01 01 00 01 00 00 00 20 01 01 .....(....... .. 0060 00 00 80 01 00 05 80 02 00 02 80 04 00 02 80 03 ................ 0070 00 01 80 0b 00 01 80 0c 70 80 0d 00 00 14 5d e9 ........p.....]. 0080 bc 4c 35 60 aa 16 cb 2d f2 5e 79 50 f1 60 0d 00 .L5`...-.^yP.`.. 0090 00 14 27 ba b5 dc 01 ea 07 60 ea 4e 31 90 ac 27 ..'......`.N1..' 00a0 c0 d0 0d 00 00 14 61 05 c4 22 e7 68 47 e4 3f 96 ......a..".hG.?. 00b0 84 80 12 92 ae cd 0d 00 00 14 44 85 15 2d 18 b6 ..........D..-.. 00c0 bb cd 0b e8 a8 46 95 79 dd cc 0d 00 00 14 cd 60 .....F.y.......` 00d0 46 43 35 df 21 f8 7c fd b2 fc 68 b6 a4 48 0d 00 FC5.!.|...h..H.. 00e0 00 14 90 cb 80 91 3e bb 69 6e 08 63 81 b5 ec 42 ......>.in.c...B 00f0 7b 1f 00 00 00 14 7d 94 19 a6 53 10 ca 6f 2c 17 {.....}...S..o,. 0100 9d 92 15 52 9d 56 10 12 53 c1 ...R.V..S. Frame 3 (274 bytes on wire, 274 bytes captured) Arrival Time: Aug 15, 2006 11:37:29.203905000 Time delta from previous packet: 0.082751000 seconds Time since reference or first frame: 0.084473000 seconds Frame Number: 3 Packet Length: 274 bytes Capture Length: 274 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa), Dst: 00:80:c8:b9:b1:b8 (00:80:c8:b9:b1:b8) Destination: 00:80:c8:b9:b1:b8 (00:80:c8:b9:b1:b8) Source: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa) Type: IP (0x0800) Frame check sequence: 0xca46d203 [correct] Internet Protocol, Src: 165.227.249.150 (165.227.249.150), Dst: 165.227.249.111 (165.227.249.111) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 256 Identification: 0x01a4 (420) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: UDP (0x11) Header checksum: 0xf97b [correct] Good: True Bad : False Source: 165.227.249.150 (165.227.249.150) Destination: 165.227.249.111 (165.227.249.111) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 236 Checksum: 0xe34c [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0x0FF09E2E6B1409AE Responder cookie: 0x3EDF56E798035FC4 Next payload: Key Exchange (4) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 228 Key Exchange payload Next payload: Nonce (10) Length: 132 Key Exchange Data Nonce payload Next payload: NAT-D (draft-ietf-ipsec-nat-t-ike-01 to 03) (130) Length: 20 Nonce Data NAT-D (draft-ietf-ipsec-nat-t-ike-01 to 03) payload Next payload: NAT-D (draft-ietf-ipsec-nat-t-ike-01 to 03) (130) Length: 24 Hash of address and port: F7924141D9693E99EDF6AF7425B6283A90B141A1 NAT-D (draft-ietf-ipsec-nat-t-ike-01 to 03) payload Next payload: NONE (0) Length: 24 Hash of address and port: 34A015651FDFBECFE18D36F4684EEED9629F8EFF 0000 00 80 c8 b9 b1 b8 00 0c 29 96 e1 fa 08 00 45 00 ........).....E. 0010 01 00 01 a4 00 00 80 11 f9 7b a5 e3 f9 96 a5 e3 .........{...... 0020 f9 6f 01 f4 01 f4 00 ec e3 4c 0f f0 9e 2e 6b 14 .o.......L....k. 0030 09 ae 3e df 56 e7 98 03 5f c4 04 10 02 00 00 00 ..>.V..._....... 0040 00 00 00 00 00 e4 0a 00 00 84 bc 5c 4f 70 6a 68 ...........\Opjh 0050 22 9b 00 06 fe fa cf 0a 0a 37 68 3e d9 33 01 4b "........7h>.3.K 0060 96 3c 4c a4 95 12 94 db 82 ac 9f 0c 2c 84 1c de .....t%. 00f0 28 3a 90 b1 41 a1 00 00 00 18 34 a0 15 65 1f df (:..A.....4..e.. 0100 be cf e1 8d 36 f4 68 4e ee d9 62 9f 8e ff ca 46 ....6.hN..b....F 0110 d2 03 .. Frame 4 (322 bytes on wire, 322 bytes captured) Arrival Time: Aug 15, 2006 11:37:29.259244000 Time delta from previous packet: 0.055339000 seconds Time since reference or first frame: 0.139812000 seconds Frame Number: 4 Packet Length: 322 bytes Capture Length: 322 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:80:c8:b9:b1:b8 (00:80:c8:b9:b1:b8), Dst: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa) Destination: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa) Source: 00:80:c8:b9:b1:b8 (00:80:c8:b9:b1:b8) Type: IP (0x0800) Frame check sequence: 0x9607a10d [correct] Internet Protocol, Src: 165.227.249.111 (165.227.249.111), Dst: 165.227.249.150 (165.227.249.150) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 304 Identification: 0xbe5d (48733) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0x7c92 [correct] Good: True Bad : False Source: 165.227.249.111 (165.227.249.111) Destination: 165.227.249.150 (165.227.249.150) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 284 Checksum: 0x0000 (none) Internet Security Association and Key Management Protocol Initiator cookie: 0x0FF09E2E6B1409AE Responder cookie: 0x3EDF56E798035FC4 Next payload: Key Exchange (4) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 276 Key Exchange payload Next payload: Nonce (10) Length: 132 Key Exchange Data Nonce payload Next payload: NAT-D (draft-ietf-ipsec-nat-t-ike-01 to 03) (130) Length: 20 Nonce Data NAT-D (draft-ietf-ipsec-nat-t-ike-01 to 03) payload Next payload: NAT-D (draft-ietf-ipsec-nat-t-ike-01 to 03) (130) Length: 24 Hash of address and port: 34A015651FDFBECFE18D36F4684EEED9629F8EFF NAT-D (draft-ietf-ipsec-nat-t-ike-01 to 03) payload Next payload: NAT-D (draft-ietf-ipsec-nat-t-ike-01 to 03) (130) Length: 24 Hash of address and port: CB8DF3747198D5C5CA0B24D06F632FBF5D4CBE84 NAT-D (draft-ietf-ipsec-nat-t-ike-01 to 03) payload Next payload: NAT-D (draft-ietf-ipsec-nat-t-ike-01 to 03) (130) Length: 24 Hash of address and port: F7924141D9693E99EDF6AF7425B6283A90B141A1 NAT-D (draft-ietf-ipsec-nat-t-ike-01 to 03) payload Next payload: NONE (0) Length: 24 Hash of address and port: CF4EB08503FD7FF0C74E6F520802050658E9E7CC 0000 00 0c 29 96 e1 fa 00 80 c8 b9 b1 b8 08 00 45 00 ..)...........E. 0010 01 30 be 5d 00 00 40 11 7c 92 a5 e3 f9 6f a5 e3 .0.]..@.|....o.. 0020 f9 96 01 f4 01 f4 01 1c 00 00 0f f0 9e 2e 6b 14 ..............k. 0030 09 ae 3e df 56 e7 98 03 5f c4 04 10 02 00 00 00 ..>.V..._....... 0040 00 00 00 00 01 14 0a 00 00 84 b6 a7 02 30 b6 45 .............0.E 0050 96 b0 95 d9 5b 6d 33 36 07 2f ab 7f 68 dc 73 5f ....[m36./..h.s_ 0060 9b 70 b0 2c 22 b3 45 05 14 3c a0 af e1 82 31 07 .p.,".E..<....1. 0070 88 b1 d9 d0 10 a9 aa 0b 20 ba 27 21 0d 92 a2 2d ........ .'!...- 0080 29 ca 32 45 aa 0c 1b 2f a5 a4 90 6e 4a 50 f6 c7 ).2E.../...nJP.. 0090 f6 d8 32 a6 18 25 fa e0 67 36 f1 90 66 fd 74 bb ..2..%..g6..f.t. 00a0 68 eb 63 42 a0 8d 7b e7 d8 d7 af fb 9a d8 ee bc h.cB..{......... 00b0 c2 5c 4c f5 f5 32 49 94 7f f2 69 c2 38 8e 35 06 .\L..2I...i.8.5. 00c0 33 58 2a 11 2b 7e 32 ba 7e 22 82 00 00 14 13 df 3X*.+~2.~"...... 00d0 b6 09 cb 59 94 60 06 53 e1 e9 50 b9 b0 bf 82 00 ...Y.`.S..P..... 00e0 00 18 34 a0 15 65 1f df be cf e1 8d 36 f4 68 4e ..4..e......6.hN 00f0 ee d9 62 9f 8e ff 82 00 00 18 cb 8d f3 74 71 98 ..b..........tq. 0100 d5 c5 ca 0b 24 d0 6f 63 2f bf 5d 4c be 84 82 00 ....$.oc/.]L.... 0110 00 18 f7 92 41 41 d9 69 3e 99 ed f6 af 74 25 b6 ....AA.i>....t%. 0120 28 3a 90 b1 41 a1 00 00 00 18 cf 4e b0 85 03 fd (:..A......N.... 0130 7f f0 c7 4e 6f 52 08 02 05 06 58 e9 e7 cc 96 07 ...NoR....X..... 0140 a1 0d .. Frame 5 (146 bytes on wire, 146 bytes captured) Arrival Time: Aug 15, 2006 11:37:29.434188000 Time delta from previous packet: 0.174944000 seconds Time since reference or first frame: 0.314756000 seconds Frame Number: 5 Packet Length: 146 bytes Capture Length: 146 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa), Dst: 00:80:c8:b9:b1:b8 (00:80:c8:b9:b1:b8) Destination: 00:80:c8:b9:b1:b8 (00:80:c8:b9:b1:b8) Source: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa) Type: IP (0x0800) Frame check sequence: 0x8a9ebaa2 [correct] Internet Protocol, Src: 165.227.249.150 (165.227.249.150), Dst: 165.227.249.111 (165.227.249.111) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 128 Identification: 0x01a5 (421) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: UDP (0x11) Header checksum: 0xf9fa [correct] Good: True Bad : False Source: 165.227.249.150 (165.227.249.150) Destination: 165.227.249.111 (165.227.249.111) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 108 Checksum: 0xcdc6 [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0x0FF09E2E6B1409AE Responder cookie: 0x3EDF56E798035FC4 Next payload: Identification (5) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 100 Encrypted payload (72 bytes) 0000 00 80 c8 b9 b1 b8 00 0c 29 96 e1 fa 08 00 45 00 ........).....E. 0010 00 80 01 a5 00 00 80 11 f9 fa a5 e3 f9 96 a5 e3 ................ 0020 f9 6f 01 f4 01 f4 00 6c cd c6 0f f0 9e 2e 6b 14 .o.....l......k. 0030 09 ae 3e df 56 e7 98 03 5f c4 05 10 02 01 00 00 ..>.V..._....... 0040 00 00 00 00 00 64 64 6e 51 d1 17 9e 5d 7b 92 12 .....ddnQ...]{.. 0050 40 d3 dc db 51 2e 6f a5 5e 57 1d 7c b0 82 7b be @...Q.o.^W.|..{. 0060 9f 07 24 28 83 8a ce 88 21 ea e9 94 b1 91 c0 55 ..$(....!......U 0070 9b dc 0e d9 1d b8 39 d6 a4 3c 3f eb 17 9d bc a8 ......9...V..._....... 0040 00 00 00 00 00 44 72 18 1a 91 6f 42 90 2a d0 3c .....Dr...oB.*.< 0050 0a 9a 62 9d 2c 7b 80 1c 9a dd 88 1d 0a 09 08 c7 ..b.,{.......... 0060 e4 66 81 cc 6a e8 e2 98 02 52 01 a9 95 bc e7 cc .f..j....R...... 0070 f3 00 .. Frame 7 (338 bytes on wire, 338 bytes captured) Arrival Time: Aug 15, 2006 11:37:29.530375000 Time delta from previous packet: 0.095123000 seconds Time since reference or first frame: 0.410943000 seconds Frame Number: 7 Packet Length: 338 bytes Capture Length: 338 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa), Dst: 00:80:c8:b9:b1:b8 (00:80:c8:b9:b1:b8) Destination: 00:80:c8:b9:b1:b8 (00:80:c8:b9:b1:b8) Source: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa) Type: IP (0x0800) Frame check sequence: 0xecc4f344 [correct] Internet Protocol, Src: 165.227.249.150 (165.227.249.150), Dst: 165.227.249.111 (165.227.249.111) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 320 Identification: 0x01a6 (422) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: UDP (0x11) Header checksum: 0xf939 [correct] Good: True Bad : False Source: 165.227.249.150 (165.227.249.150) Destination: 165.227.249.111 (165.227.249.111) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 300 Checksum: 0xc219 [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0x0FF09E2E6B1409AE Responder cookie: 0x3EDF56E798035FC4 Next payload: Hash (8) Version: 1.0 Exchange type: Quick Mode (32) Flags .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x7C9E6874 Length: 292 Encrypted payload (264 bytes) 0000 00 80 c8 b9 b1 b8 00 0c 29 96 e1 fa 08 00 45 00 ........).....E. 0010 01 40 01 a6 00 00 80 11 f9 39 a5 e3 f9 96 a5 e3 .@.......9...... 0020 f9 6f 01 f4 01 f4 01 2c c2 19 0f f0 9e 2e 6b 14 .o.....,......k. 0030 09 ae 3e df 56 e7 98 03 5f c4 08 10 20 01 7c 9e ..>.V..._... .|. 0040 68 74 00 00 01 24 26 f9 8a d4 49 46 fc ba b7 25 ht...$&...IF...% 0050 71 70 88 37 2b 8f 31 94 bd 59 61 fc 19 c3 e7 28 qp.7+.1..Ya....( 0060 a1 15 4a 12 5c f1 7b cb 60 75 cb 32 58 b9 52 72 ..J.\.{.`u.2X.Rr 0070 f1 73 a4 dd c4 d4 37 39 8f 19 02 77 b7 44 fe 5c .s....79...w.D.\ 0080 96 7a 00 1a 18 fa 19 e1 0f 23 35 c5 42 5b 23 b4 .z.......#5.B[#. 0090 a3 b9 50 be e7 28 28 37 66 8c 69 a6 59 ed cf 89 ..P..((7f.i.Y... 00a0 83 83 c6 bf 3e 4a a0 de 52 92 1b 93 90 a8 b8 8a ....>J..R....... 00b0 f9 a0 25 06 0f 38 e8 09 4f 05 53 9c 0e ce f3 f6 ..%..8..O.S..... 00c0 0b ec 33 0d de c7 6a 30 3b 3a eb 4a 0e df fb f0 ..3...j0;:.J.... 00d0 6c e5 92 e0 dc 5e 6d 28 b7 46 3d 9f 29 49 5b 28 l....^m(.F=.)I[( 00e0 a1 4b 7c 64 b1 fa b1 4b 0b 7c c9 31 60 71 9b f2 .K|d...K.|.1`q.. 00f0 23 7a 2d 61 04 36 16 7b c6 ef 49 57 49 d4 22 3d #z-a.6.{..IWI."= 0100 13 2c 77 e5 10 3d f6 e7 6a 70 1b f6 9b d6 f6 a0 .,w..=..jp...... 0110 91 4e f0 31 87 a9 d4 3d 7e 37 be 22 5e 41 53 c9 .N.1...=~7."^AS. 0120 13 a6 bf 25 d9 52 76 11 1d e7 1f 4e 3a 40 5e 4b ...%.Rv....N:@^K 0130 09 31 72 ad f2 32 6c d6 f1 98 8a c4 43 57 fc ed .1r..2l.....CW.. 0140 06 3e e1 8a 1d 07 47 d2 9b 1e e0 3a 0d 93 ec c4 .>....G....:.... 0150 f3 44 .D Frame 8 (330 bytes on wire, 330 bytes captured) Arrival Time: Aug 15, 2006 11:37:29.558233000 Time delta from previous packet: 0.027858000 seconds Time since reference or first frame: 0.438801000 seconds Frame Number: 8 Packet Length: 330 bytes Capture Length: 330 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:80:c8:b9:b1:b8 (00:80:c8:b9:b1:b8), Dst: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa) Destination: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa) Source: 00:80:c8:b9:b1:b8 (00:80:c8:b9:b1:b8) Type: IP (0x0800) Frame check sequence: 0x57fa2baf [correct] Internet Protocol, Src: 165.227.249.111 (165.227.249.111), Dst: 165.227.249.150 (165.227.249.150) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 312 Identification: 0x9e50 (40528) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0x9c97 [correct] Good: True Bad : False Source: 165.227.249.111 (165.227.249.111) Destination: 165.227.249.150 (165.227.249.150) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 292 Checksum: 0x0000 (none) Internet Security Association and Key Management Protocol Initiator cookie: 0x0FF09E2E6B1409AE Responder cookie: 0x3EDF56E798035FC4 Next payload: Hash (8) Version: 1.0 Exchange type: Quick Mode (32) Flags .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x7C9E6874 Length: 284 Encrypted payload (256 bytes) 0000 00 0c 29 96 e1 fa 00 80 c8 b9 b1 b8 08 00 45 00 ..)...........E. 0010 01 38 9e 50 00 00 40 11 9c 97 a5 e3 f9 6f a5 e3 .8.P..@......o.. 0020 f9 96 01 f4 01 f4 01 24 00 00 0f f0 9e 2e 6b 14 .......$......k. 0030 09 ae 3e df 56 e7 98 03 5f c4 08 10 20 01 7c 9e ..>.V..._... .|. 0040 68 74 00 00 01 1c fd d0 a9 25 e5 53 f9 11 1b 53 ht.......%.S...S 0050 8e b6 51 0e 52 bb c8 dc de 0f 36 82 04 e7 ab 14 ..Q.R.....6..... 0060 a0 8a 78 e4 d3 c9 db 72 ce d4 91 24 8f 65 b7 c3 ..x....r...$.e.. 0070 5c 65 6d 83 c2 36 e0 64 76 23 af 5e 3a 87 84 47 \em..6.dv#.^:..G 0080 e8 a1 53 96 e6 a7 ca 51 81 7e 64 29 b3 8a 1d 1e ..S....Q.~d).... 0090 c1 22 a1 15 03 4f 2c 2e 23 b8 be a9 da 0b 83 2d ."...O,.#......- 00a0 ca dc f5 ee 9f 4d 2f 3e a8 01 84 ba c8 37 27 e0 .....M/>.....7'. 00b0 24 5c b0 f8 2c b3 bb aa 4e 56 cf 59 b5 06 b4 55 $\..,...NV.Y...U 00c0 23 0c dd fe 87 5e 63 ac cd 14 e7 79 37 c8 3d bc #....^c....y7.=. 00d0 3f f9 c4 9d a2 e9 5c a5 ad 5f 3a 56 0b 38 7d c8 ?.....\.._:V.8}. 00e0 e0 62 90 e6 b3 c3 fe f3 9a 58 21 9e ac 72 e9 79 .b.......X!..r.y 00f0 cb 05 1e 76 ba 0a af 0c ae 36 5b 10 b7 e9 f4 61 ...v.....6[....a 0100 ef 30 b0 5a 79 ae 12 10 71 b3 89 8b c2 2f 98 1e .0.Zy...q..../.. 0110 c4 88 24 41 35 9a af bd 21 f1 c1 15 7d 70 2c 0c ..$A5...!...}p,. 0120 04 63 0c d2 b9 ea 0a cd ba 70 de fb 1c f5 3c c4 .c.......p....<. 0130 03 61 32 34 44 20 d4 c8 80 84 7a c3 60 4b 59 a8 .a24D ....z.`KY. 0140 b8 f5 c6 e0 01 6b 57 fa 2b af .....kW.+. Frame 9 (106 bytes on wire, 106 bytes captured) Arrival Time: Aug 15, 2006 11:37:30.030421000 Time delta from previous packet: 0.472188000 seconds Time since reference or first frame: 0.910989000 seconds Frame Number: 9 Packet Length: 106 bytes Capture Length: 106 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa), Dst: 00:80:c8:b9:b1:b8 (00:80:c8:b9:b1:b8) Destination: 00:80:c8:b9:b1:b8 (00:80:c8:b9:b1:b8) Source: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa) Type: IP (0x0800) Frame check sequence: 0xd619edc2 [correct] Internet Protocol, Src: 165.227.249.150 (165.227.249.150), Dst: 165.227.249.111 (165.227.249.111) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 88 Identification: 0x01a7 (423) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: UDP (0x11) Header checksum: 0xfa20 [correct] Good: True Bad : False Source: 165.227.249.150 (165.227.249.150) Destination: 165.227.249.111 (165.227.249.111) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 68 Checksum: 0x18bc [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0x0FF09E2E6B1409AE Responder cookie: 0x3EDF56E798035FC4 Next payload: Hash (8) Version: 1.0 Exchange type: Quick Mode (32) Flags .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x7C9E6874 Length: 60 Encrypted payload (32 bytes) 0000 00 80 c8 b9 b1 b8 00 0c 29 96 e1 fa 08 00 45 00 ........).....E. 0010 00 58 01 a7 00 00 80 11 fa 20 a5 e3 f9 96 a5 e3 .X....... ...... 0020 f9 6f 01 f4 01 f4 00 44 18 bc 0f f0 9e 2e 6b 14 .o.....D......k. 0030 09 ae 3e df 56 e7 98 03 5f c4 08 10 20 01 7c 9e ..>.V..._... .|. 0040 68 74 00 00 00 3c 92 f1 1f 6d 6e b2 03 73 7b 00 ht...<...mn..s{. 0050 9c bf 4e fe 5c c7 0f 1c 6e 39 b8 be b8 10 ff 50 ..N.\...n9.....P 0060 2c 80 39 07 ab 1d d6 19 ed c2 ,.9....... Frame 10 (402 bytes on wire, 402 bytes captured) Arrival Time: Aug 15, 2006 11:37:33.647332000 Time delta from previous packet: 3.616911000 seconds Time since reference or first frame: 4.527900000 seconds Frame Number: 10 Packet Length: 402 bytes Capture Length: 402 bytes Protocols in frame: eth:ip:esp:data Ethernet II, Src: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa), Dst: 00:80:c8:b9:b1:b8 (00:80:c8:b9:b1:b8) Destination: 00:80:c8:b9:b1:b8 (00:80:c8:b9:b1:b8) Source: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa) Type: IP (0x0800) Frame check sequence: 0xb751e52d [correct] Internet Protocol, Src: 165.227.249.150 (165.227.249.150), Dst: 165.227.249.111 (165.227.249.111) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 384 Identification: 0x01a8 (424) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: ESP (0x32) Header checksum: 0xf8d6 [correct] Good: True Bad : False Source: 165.227.249.150 (165.227.249.150) Destination: 165.227.249.111 (165.227.249.111) Encapsulating Security Payload SPI: 0xbafaaec9 Sequence: 1 Data (356 bytes) 0000 00 80 c8 b9 b1 b8 00 0c 29 96 e1 fa 08 00 45 00 ........).....E. 0010 01 80 01 a8 00 00 80 32 f8 d6 a5 e3 f9 96 a5 e3 .......2........ 0020 f9 6f ba fa ae c9 00 00 00 01 58 78 cb 33 f8 88 .o........Xx.3.. 0030 60 b7 d1 c2 b6 eb 37 33 13 b6 83 7b f8 ea 16 a9 `.....73...{.... 0040 64 64 ef 94 ac cb b2 b0 09 8d 6b 6c 5b a1 5f d4 dd........kl[._. 0050 2c 8d 58 ce c6 64 c2 a2 c9 7d 79 a8 5c a2 69 82 ,.X..d...}y.\.i. 0060 d2 14 f3 28 40 eb 8f d5 18 33 67 e2 07 38 f9 ba ...(@....3g..8.. 0070 af fe 5b 9e 04 e9 36 4b af de 95 69 a5 dd 5c 24 ..[...6K...i..\$ 0080 d8 10 6e 0f 1a cf 0c 58 30 e7 9f b3 2b 3a e6 b6 ..n....X0...+:.. 0090 67 b8 a2 1a 5a cb 56 38 b2 34 ae 72 76 7e bc ca g...Z.V8.4.rv~.. 00a0 cb 35 3d bb 2d e3 83 b5 4f 82 d0 98 28 ba b9 3d .5=.-...O...(..= 00b0 a7 b2 1d 23 b3 f9 d8 0b 3a f4 ba 3c d4 60 90 0b ...#....:..<.`.. 00c0 f1 b9 05 ee 55 06 de ef 8c ac 17 e8 55 fb 2a 1a ....U.......U.*. 00d0 1f 01 07 a6 e5 2f 39 08 52 00 e8 c4 38 d7 81 34 ...../9.R...8..4 00e0 e4 5c 4d b7 ce 7f 2a f2 dd 5b 08 2b 65 9a 6c 2c .\M...*..[.+e.l, 00f0 68 de 9b dd a5 37 f3 b4 4a 02 26 69 39 3e a2 73 h....7..J.&i9>.s 0100 81 ff b3 bd a9 07 fe 0d b6 cc 8c 7b f3 fb b3 a6 ...........{.... 0110 fa 31 82 6f ee 3a ba 42 8a ae 0a e9 f0 e5 35 96 .1.o.:.B......5. 0120 a2 7f e6 48 c2 41 81 31 bd 06 a8 0f e0 c7 2b 5f ...H.A.1......+_ 0130 0e 46 9e f9 08 90 ef f1 0e a6 2c 2a 7c 03 bf 21 .F........,*|..! 0140 ff 53 08 f1 2d 88 2a f9 46 b2 33 9d 5f 85 8a 32 .S..-.*.F.3._..2 0150 5a 04 da 48 c6 3e f8 b5 1a b3 ae 71 48 96 97 22 Z..H.>.....qH.." 0160 d3 f4 d9 12 ac b2 cb 65 f4 93 b2 fd eb ba 3f d2 .......e......?. 0170 2b 65 66 6c 73 b6 a2 f2 c4 b4 45 bc 96 bc b3 b3 +efls.....E..... 0180 75 d3 50 0f 94 21 43 79 40 88 48 e8 56 7e b7 51 u.P..!Cy@.H.V~.Q 0190 e5 2d .- Frame 11 (402 bytes on wire, 402 bytes captured) Arrival Time: Aug 15, 2006 11:37:33.649490000 Time delta from previous packet: 0.002158000 seconds Time since reference or first frame: 4.530058000 seconds Frame Number: 11 Packet Length: 402 bytes Capture Length: 402 bytes Protocols in frame: eth:ip:esp:data Ethernet II, Src: 00:80:c8:b9:b1:b8 (00:80:c8:b9:b1:b8), Dst: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa) Destination: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa) Source: 00:80:c8:b9:b1:b8 (00:80:c8:b9:b1:b8) Type: IP (0x0800) Frame check sequence: 0xb1808b8d [correct] Internet Protocol, Src: 165.227.249.111 (165.227.249.111), Dst: 165.227.249.150 (165.227.249.150) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 384 Identification: 0x0000 (0) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 240 Protocol: ESP (0x32) Header checksum: 0x8a7e [correct] Good: True Bad : False Source: 165.227.249.111 (165.227.249.111) Destination: 165.227.249.150 (165.227.249.150) Encapsulating Security Payload SPI: 0x35702911 Sequence: 1 Data (356 bytes) 0000 00 0c 29 96 e1 fa 00 80 c8 b9 b1 b8 08 00 45 00 ..)...........E. 0010 01 80 00 00 00 00 f0 32 8a 7e a5 e3 f9 6f a5 e3 .......2.~...o.. 0020 f9 96 35 70 29 11 00 00 00 01 fe c8 26 b1 00 55 ..5p).......&..U 0030 e1 25 e0 66 7b cc fe 83 71 be 15 d6 01 ca d9 59 .%.f{...q......Y 0040 78 4c 7e 76 f8 7e 81 3c 57 68 68 8d 71 9f db 2d xL~v.~.)i...LXl..}.) 0080 bc 31 ea 82 23 5a 0d 81 41 f2 e0 3a 31 9a 9f cd .1..#Z..A..:1... 0090 19 9f 63 d8 11 a9 aa 73 be 27 3d 72 04 fe 18 44 ..c....s.'=r...D 00a0 52 d0 25 a9 32 78 d4 cc 95 63 91 41 83 52 e4 35 R.%.2x...c.A.R.5 00b0 20 bb 9b d2 f9 f4 a2 95 3a 2c 82 b1 9d 4e 49 53 .......:,...NIS 00c0 7f 9c 84 7a 95 fe 47 27 43 4e ec 90 3f 32 13 af ...z..G'CN..?2.. 00d0 94 8c ec 74 7b 3b 1e d5 e1 22 51 17 10 50 d0 f6 ...t{;..."Q..P.. 00e0 95 dc 9e 59 8e 81 89 f5 e7 6d 01 db 62 c1 c7 e1 ...Y.....m..b... 00f0 74 35 8b d6 82 fa 0c 3d 4c 05 7f ff b3 62 dd be t5.....=L....b.. 0100 82 ff 8a e9 5d af 4c 91 b8 2a 3e 00 4d 9b 4e 3c ....].L..*>.M.N< 0110 64 2c 40 db ec 86 46 a9 ba 8b d1 69 34 65 3e 9d d,@...F....i4e>. 0120 22 3f a7 2e 8e ca 62 81 48 88 e9 49 ff 8f ce 93 "?....b.H..I.... 0130 d6 fa 17 b9 52 7f 7c dc 13 7e 6e 0f 44 25 2d b9 ....R.|..~n.D%-. 0140 b6 9b df a5 2d 5f db f4 cc 21 cf c3 d9 0e f8 e7 ....-_...!...... 0150 23 45 fe 2f b4 e5 e7 11 aa 54 61 63 97 e2 c4 4f #E./.....Tac...O 0160 bd 3e c9 07 6f 04 c5 fe c1 c8 44 76 51 e7 cc 2a .>..o.....DvQ..* 0170 b5 e0 5e a9 75 34 27 d6 22 c1 5b 35 41 71 e4 14 ..^.u4'.".[5Aq.. 0180 66 3e 7b d4 a5 a1 23 ef ae 31 23 c1 e5 a9 b1 80 f>{...#..1#..... 0190 8b 8d ..