Frame 1 (222 bytes on wire, 222 bytes captured) Arrival Time: Aug 10, 2006 13:47:18.649150000 Time delta from previous packet: 0.000000000 seconds Time since reference or first frame: 0.000000000 seconds Frame Number: 1 Packet Length: 222 bytes Capture Length: 222 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa), Dst: 00:10:db:16:db:f6 (00:10:db:16:db:f6) Destination: 00:10:db:16:db:f6 (00:10:db:16:db:f6) Source: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.150 (165.227.249.150), Dst: 165.227.249.117 (165.227.249.117) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 208 Identification: 0x0186 (390) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: UDP (0x11) Header checksum: 0xf9c3 [correct] Good: True Bad : False Source: 165.227.249.150 (165.227.249.150) Destination: 165.227.249.117 (165.227.249.117) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 188 Checksum: 0x7290 [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0x04EAD57B2D8B5C17 Responder cookie: 0x0000000000000000 Next payload: Security Association (1) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 180 Security Association payload Next payload: Vendor ID (13) Length: 52 Domain of interpretation: IPSEC (1) Situation: IDENTITY (1) Proposal payload # 1 Next payload: NONE (0) Length: 40 Proposal number: 1 Protocol ID: ISAKMP (1) SPI size: 0 Number of transforms: 1 Transform payload # 1 Next payload: NONE (0) Length: 32 Transform number: 1 Transform ID: KEY_IKE (1) Encryption-Algorithm (1): 3DES-CBC (5) Hash-Algorithm (2): SHA (2) Group-Description (4): Alternate 1024-bit MODP group (2) Authentication-Method (3): PSK (1) Life-Type (11): Seconds (1) Life-Duration (12): Duration-Value (28800) Vendor ID payload Next payload: Vendor ID (13) Length: 20 Vendor ID: unknown vendor ID: 0x4A131C81070358455C5728F20E95452F Vendor ID payload Next payload: Vendor ID (13) Length: 20 Vendor ID: draft-ietf-ipsec-nat-t-ike-03 Vendor ID payload Next payload: Vendor ID (13) Length: 20 Vendor ID: draft-ietf-ipsec-nat-t-ike-02 Vendor ID payload Next payload: Vendor ID (13) Length: 20 Vendor ID: draft-ietf-ipsec-nat-t-ike-00 Vendor ID payload Next payload: NONE (0) Length: 20 Vendor ID: RFC 3706 Detecting Dead IKE Peers (DPD) 0000 00 10 db 16 db f6 00 0c 29 96 e1 fa 08 00 45 00 ........).....E. 0010 00 d0 01 86 00 00 80 11 f9 c3 a5 e3 f9 96 a5 e3 ................ 0020 f9 75 01 f4 01 f4 00 bc 72 90 04 ea d5 7b 2d 8b .u......r....{-. 0030 5c 17 00 00 00 00 00 00 00 00 01 10 02 00 00 00 \............... 0040 00 00 00 00 00 b4 0d 00 00 34 00 00 00 01 00 00 .........4...... 0050 00 01 00 00 00 28 01 01 00 01 00 00 00 20 01 01 .....(....... .. 0060 00 00 80 01 00 05 80 02 00 02 80 04 00 02 80 03 ................ 0070 00 01 80 0b 00 01 80 0c 70 80 0d 00 00 14 4a 13 ........p.....J. 0080 1c 81 07 03 58 45 5c 57 28 f2 0e 95 45 2f 0d 00 ....XE\W(...E/.. 0090 00 14 7d 94 19 a6 53 10 ca 6f 2c 17 9d 92 15 52 ..}...S..o,....R 00a0 9d 56 0d 00 00 14 90 cb 80 91 3e bb 69 6e 08 63 .V........>.in.c 00b0 81 b5 ec 42 7b 1f 0d 00 00 14 44 85 15 2d 18 b6 ...B{.....D..-.. 00c0 bb cd 0b e8 a8 46 95 79 dd cc 00 00 00 14 af ca .....F.y........ 00d0 d7 13 68 a1 f1 c9 6b 86 96 fc 77 57 01 00 ..h...k...wW.. Frame 2 (198 bytes on wire, 198 bytes captured) Arrival Time: Aug 10, 2006 13:47:18.649237000 Time delta from previous packet: 0.000087000 seconds Time since reference or first frame: 0.000087000 seconds Frame Number: 2 Packet Length: 198 bytes Capture Length: 198 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:10:db:16:db:f6 (00:10:db:16:db:f6), Dst: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa) Destination: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa) Source: 00:10:db:16:db:f6 (00:10:db:16:db:f6) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.117 (165.227.249.117), Dst: 165.227.249.150 (165.227.249.150) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 184 Identification: 0x04d3 (1235) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0x368f [correct] Good: True Bad : False Source: 165.227.249.117 (165.227.249.117) Destination: 165.227.249.150 (165.227.249.150) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 164 Checksum: 0xadd6 [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0x04EAD57B2D8B5C17 Responder cookie: 0xA9A8DF1F354516A2 Next payload: Security Association (1) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 156 Security Association payload Next payload: Vendor ID (13) Length: 52 Domain of interpretation: IPSEC (1) Situation: IDENTITY (1) Proposal payload # 1 Next payload: NONE (0) Length: 40 Proposal number: 1 Protocol ID: ISAKMP (1) SPI size: 0 Number of transforms: 1 Transform payload # 1 Next payload: NONE (0) Length: 32 Transform number: 1 Transform ID: KEY_IKE (1) Encryption-Algorithm (1): 3DES-CBC (5) Hash-Algorithm (2): SHA (2) Group-Description (4): Alternate 1024-bit MODP group (2) Authentication-Method (3): PSK (1) Life-Type (11): Seconds (1) Life-Duration (12): Duration-Value (28800) Vendor ID payload Next payload: Vendor ID (13) Length: 32 Vendor ID: unknown vendor ID: 0x166F932D55EB64D8E4DF4FD37E2313F0D0FD845100000000... Vendor ID payload Next payload: Vendor ID (13) Length: 20 Vendor ID: RFC 3706 Detecting Dead IKE Peers (DPD) Vendor ID payload Next payload: NONE (0) Length: 24 Vendor ID: unknown vendor ID: 0x4865617274426561745F4E6F74696679386B0100 0000 00 0c 29 96 e1 fa 00 10 db 16 db f6 08 00 45 00 ..)...........E. 0010 00 b8 04 d3 00 00 40 11 36 8f a5 e3 f9 75 a5 e3 ......@.6....u.. 0020 f9 96 01 f4 01 f4 00 a4 ad d6 04 ea d5 7b 2d 8b .............{-. 0030 5c 17 a9 a8 df 1f 35 45 16 a2 01 10 02 00 00 00 \.....5E........ 0040 00 00 00 00 00 9c 0d 00 00 34 00 00 00 01 00 00 .........4...... 0050 00 01 00 00 00 28 01 01 00 01 00 00 00 20 01 01 .....(....... .. 0060 00 00 80 01 00 05 80 02 00 02 80 04 00 02 80 03 ................ 0070 00 01 80 0b 00 01 80 0c 70 80 0d 00 00 20 16 6f ........p.... .o 0080 93 2d 55 eb 64 d8 e4 df 4f d3 7e 23 13 f0 d0 fd .-U.d...O.~#.... 0090 84 51 00 00 00 00 00 00 00 00 0d 00 00 14 af ca .Q.............. 00a0 d7 13 68 a1 f1 c9 6b 86 96 fc 77 57 01 00 00 00 ..h...k...wW.... 00b0 00 18 48 65 61 72 74 42 65 61 74 5f 4e 6f 74 69 ..HeartBeat_Noti 00c0 66 79 38 6b 01 00 fy8k.. Frame 3 (222 bytes on wire, 222 bytes captured) Arrival Time: Aug 10, 2006 13:47:18.692287000 Time delta from previous packet: 0.043050000 seconds Time since reference or first frame: 0.043137000 seconds Frame Number: 3 Packet Length: 222 bytes Capture Length: 222 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa), Dst: 00:10:db:16:db:f6 (00:10:db:16:db:f6) Destination: 00:10:db:16:db:f6 (00:10:db:16:db:f6) Source: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.150 (165.227.249.150), Dst: 165.227.249.117 (165.227.249.117) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 208 Identification: 0x0187 (391) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: UDP (0x11) Header checksum: 0xf9c2 [correct] Good: True Bad : False Source: 165.227.249.150 (165.227.249.150) Destination: 165.227.249.117 (165.227.249.117) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 188 Checksum: 0xa44d [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0x04EAD57B2D8B5C17 Responder cookie: 0xA9A8DF1F354516A2 Next payload: Key Exchange (4) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 180 Key Exchange payload Next payload: Nonce (10) Length: 132 Key Exchange Data Nonce payload Next payload: NONE (0) Length: 20 Nonce Data 0000 00 10 db 16 db f6 00 0c 29 96 e1 fa 08 00 45 00 ........).....E. 0010 00 d0 01 87 00 00 80 11 f9 c2 a5 e3 f9 96 a5 e3 ................ 0020 f9 75 01 f4 01 f4 00 bc a4 4d 04 ea d5 7b 2d 8b .u.......M...{-. 0030 5c 17 a9 a8 df 1f 35 45 16 a2 04 10 02 00 00 00 \.....5E........ 0040 00 00 00 00 00 b4 0a 00 00 84 30 f8 dd df 96 ad ..........0..... 0050 03 d4 5b 0d 06 09 5f 1c b8 b1 b0 16 5b 60 89 4d ..[..._.....[`.M 0060 65 df 68 b2 38 3d 24 52 98 f9 52 aa 22 b0 97 2e e.h.8=$R..R."... 0070 0c bc 5f 00 bd 3c 08 2c 96 be 45 b1 ed c2 2c e8 .._..<.,..E...,. 0080 42 5d f2 ec 96 91 34 d7 7f 30 91 30 85 cb 83 44 B]....4..0.0...D 0090 d5 a4 13 b0 9e 44 02 22 4b 8b c2 a9 78 82 0c 23 .....D."K...x..# 00a0 17 6f e9 10 ba c2 3c b6 5a f5 d2 4d e0 88 39 f0 .o....<.Z..M..9. 00b0 8c 3a 7d 82 20 e8 f2 fc 35 8b 45 87 ad 4d 88 f5 .:}. ...5.E..M.. 00c0 63 9d 07 b9 8d f8 cb d1 d5 3e 00 00 00 14 7e b2 c........>....~. 00d0 41 15 ae c3 79 ad 2a bc 8f 5c b4 a9 e6 af A...y.*..\.... Frame 4 (226 bytes on wire, 226 bytes captured) Arrival Time: Aug 10, 2006 13:47:18.712457000 Time delta from previous packet: 0.020170000 seconds Time since reference or first frame: 0.063307000 seconds Frame Number: 4 Packet Length: 226 bytes Capture Length: 226 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:10:db:16:db:f6 (00:10:db:16:db:f6), Dst: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa) Destination: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa) Source: 00:10:db:16:db:f6 (00:10:db:16:db:f6) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.117 (165.227.249.117), Dst: 165.227.249.150 (165.227.249.150) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 212 Identification: 0x04d4 (1236) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0x3672 [correct] Good: True Bad : False Source: 165.227.249.117 (165.227.249.117) Destination: 165.227.249.150 (165.227.249.150) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 192 Checksum: 0x7ff9 [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0x04EAD57B2D8B5C17 Responder cookie: 0xA9A8DF1F354516A2 Next payload: Key Exchange (4) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 184 Key Exchange payload Next payload: Nonce (10) Length: 132 Key Exchange Data Nonce payload Next payload: NONE (0) Length: 24 Nonce Data 0000 00 0c 29 96 e1 fa 00 10 db 16 db f6 08 00 45 00 ..)...........E. 0010 00 d4 04 d4 00 00 40 11 36 72 a5 e3 f9 75 a5 e3 ......@.6r...u.. 0020 f9 96 01 f4 01 f4 00 c0 7f f9 04 ea d5 7b 2d 8b .............{-. 0030 5c 17 a9 a8 df 1f 35 45 16 a2 04 10 02 00 00 00 \.....5E........ 0040 00 00 00 00 00 b8 0a 00 00 84 32 95 81 42 3e 29 ..........2..B>) 0050 5f 4c 5c ec b7 18 a7 7a fc e8 98 b0 46 70 3b 27 _L\....z....Fp;' 0060 90 9b 84 0d 6a 92 c0 14 95 07 e7 39 30 1d e8 1c ....j......90... 0070 49 fc db 3b cc 77 7b 60 17 0a 47 64 ee a9 e0 13 I..;.w{`..Gd.... 0080 47 a0 71 95 27 cd 2c 82 3c f7 2d 3b 2c d8 17 a1 G.q.'.,.<.-;,... 0090 b3 71 0a 47 7a fc 57 17 89 48 d2 27 1a a1 76 68 .q.Gz.W..H.'..vh 00a0 b3 45 0e ec f9 89 f2 0f dc 19 a7 44 39 3c 02 fd .E.........D9<.. 00b0 d3 ce 52 03 03 ad bb aa fc 2a 81 8c e3 bf b9 c3 ..R......*...... 00c0 f2 16 ab bb 88 f0 d3 d1 a4 13 00 00 00 18 f3 e1 ................ 00d0 56 4f b5 24 62 2e 41 60 66 83 c2 42 b2 0d f5 5e VO.$b.A`f..B...^ 00e0 a7 96 .. Frame 5 (142 bytes on wire, 142 bytes captured) Arrival Time: Aug 10, 2006 13:47:18.770619000 Time delta from previous packet: 0.058162000 seconds Time since reference or first frame: 0.121469000 seconds Frame Number: 5 Packet Length: 142 bytes Capture Length: 142 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa), Dst: 00:10:db:16:db:f6 (00:10:db:16:db:f6) Destination: 00:10:db:16:db:f6 (00:10:db:16:db:f6) Source: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.150 (165.227.249.150), Dst: 165.227.249.117 (165.227.249.117) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 128 Identification: 0x0188 (392) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: UDP (0x11) Header checksum: 0xfa11 [correct] Good: True Bad : False Source: 165.227.249.150 (165.227.249.150) Destination: 165.227.249.117 (165.227.249.117) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 108 Checksum: 0xa864 [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0x04EAD57B2D8B5C17 Responder cookie: 0xA9A8DF1F354516A2 Next payload: Identification (5) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 100 Encrypted payload (72 bytes) 0000 00 10 db 16 db f6 00 0c 29 96 e1 fa 08 00 45 00 ........).....E. 0010 00 80 01 88 00 00 80 11 fa 11 a5 e3 f9 96 a5 e3 ................ 0020 f9 75 01 f4 01 f4 00 6c a8 64 04 ea d5 7b 2d 8b .u.....l.d...{-. 0030 5c 17 a9 a8 df 1f 35 45 16 a2 05 10 02 01 00 00 \.....5E........ 0040 00 00 00 00 00 64 65 2a 8f cb 05 31 a1 38 59 9b .....de*...1.8Y. 0050 9d ca c0 97 54 ad 42 36 03 a5 45 26 0e 1c b6 58 ....T.B6..E&...X 0060 da cd b9 fa b5 49 be 8f 0f 82 85 e4 a9 b5 90 ad .....I.......... 0070 68 23 75 c8 7a b0 4f 8f 5e 57 d8 34 78 c7 78 9d h#u.z.O.^W.4x.x. 0080 cd 21 29 6c fa eb c5 75 7c a5 01 03 ff 26 .!)l...u|....& Frame 6 (110 bytes on wire, 110 bytes captured) Arrival Time: Aug 10, 2006 13:47:18.780206000 Time delta from previous packet: 0.009587000 seconds Time since reference or first frame: 0.131056000 seconds Frame Number: 6 Packet Length: 110 bytes Capture Length: 110 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:10:db:16:db:f6 (00:10:db:16:db:f6), Dst: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa) Destination: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa) Source: 00:10:db:16:db:f6 (00:10:db:16:db:f6) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.117 (165.227.249.117), Dst: 165.227.249.150 (165.227.249.150) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 96 Identification: 0x04d5 (1237) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0x36e5 [correct] Good: True Bad : False Source: 165.227.249.117 (165.227.249.117) Destination: 165.227.249.150 (165.227.249.150) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 76 Checksum: 0x5417 [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0x04EAD57B2D8B5C17 Responder cookie: 0xA9A8DF1F354516A2 Next payload: Identification (5) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 68 Encrypted payload (40 bytes) 0000 00 0c 29 96 e1 fa 00 10 db 16 db f6 08 00 45 00 ..)...........E. 0010 00 60 04 d5 00 00 40 11 36 e5 a5 e3 f9 75 a5 e3 .`....@.6....u.. 0020 f9 96 01 f4 01 f4 00 4c 54 17 04 ea d5 7b 2d 8b .......LT....{-. 0030 5c 17 a9 a8 df 1f 35 45 16 a2 05 10 02 01 00 00 \.....5E........ 0040 00 00 00 00 00 44 51 a4 70 c8 26 d4 de 4d 03 e6 .....DQ.p.&..M.. 0050 e1 e4 d4 03 aa 62 7a d9 a0 cb 7c 82 4c 5d dc 82 .....bz...|.L].. 0060 92 13 7a ad 5c 98 10 90 8b cd f9 d9 3c 1d ..z.\.......<. Frame 7 (334 bytes on wire, 334 bytes captured) Arrival Time: Aug 10, 2006 13:47:18.801922000 Time delta from previous packet: 0.021716000 seconds Time since reference or first frame: 0.152772000 seconds Frame Number: 7 Packet Length: 334 bytes Capture Length: 334 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa), Dst: 00:10:db:16:db:f6 (00:10:db:16:db:f6) Destination: 00:10:db:16:db:f6 (00:10:db:16:db:f6) Source: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.150 (165.227.249.150), Dst: 165.227.249.117 (165.227.249.117) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 320 Identification: 0x0189 (393) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: UDP (0x11) Header checksum: 0xf950 [correct] Good: True Bad : False Source: 165.227.249.150 (165.227.249.150) Destination: 165.227.249.117 (165.227.249.117) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 300 Checksum: 0x34a1 [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0x04EAD57B2D8B5C17 Responder cookie: 0xA9A8DF1F354516A2 Next payload: Hash (8) Version: 1.0 Exchange type: Quick Mode (32) Flags .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0xB0806F15 Length: 292 Encrypted payload (264 bytes) 0000 00 10 db 16 db f6 00 0c 29 96 e1 fa 08 00 45 00 ........).....E. 0010 01 40 01 89 00 00 80 11 f9 50 a5 e3 f9 96 a5 e3 .@.......P...... 0020 f9 75 01 f4 01 f4 01 2c 34 a1 04 ea d5 7b 2d 8b .u.....,4....{-. 0030 5c 17 a9 a8 df 1f 35 45 16 a2 08 10 20 01 b0 80 \.....5E.... ... 0040 6f 15 00 00 01 24 59 89 7b e2 4d 4e 7d 74 16 5e o....$Y.{.MN}t.^ 0050 d3 a1 a8 d3 76 6b 9a 4a 3a 9e 07 f2 7e a5 b1 72 ....vk.J:...~..r 0060 80 6e 1a 12 23 3c 59 1a e8 5f ae 82 49 28 3a 2b .n..#...A.V 00b0 0f d4 3e a4 44 3c 7b 3c 39 11 61 7e 4c 27 59 c4 ..>.D<{<9.a~L'Y. 00c0 2d 56 b6 f1 30 4d 3f 49 af 33 71 23 f6 85 cd 76 -V..0M?I.3q#...v 00d0 3e 05 35 6d 57 f6 76 d9 29 3f 0b 93 65 f2 97 b7 >.5mW.v.)?..e... 00e0 9e 2b 8d 11 8b 2a 07 bd 32 a9 22 5c bd 59 49 c3 .+...*..2."\.YI. 00f0 8c e2 fc bb 3e 9e 87 43 58 b0 f8 fe bc af ee 0f ....>..CX....... 0100 f3 0e 35 5d 78 47 4c 47 4c 69 8f d6 b1 3d ed 8e ..5]xGLGLi...=.. 0110 19 f2 9f 75 cc e3 b3 2b 2b 98 0e 12 e1 cd 85 94 ...u...++....... 0120 38 81 7c ab fa 95 63 0a 22 b8 96 b4 75 aa 1a b4 8.|...c."...u... 0130 97 48 73 67 ea 7c d1 ad 43 5f 52 80 96 26 ee a3 .Hsg.|..C_R..&.. 0140 54 45 14 f0 62 56 34 5b 4b 07 53 6e ba 1c TE..bV4[K.Sn.. Frame 8 (342 bytes on wire, 342 bytes captured) Arrival Time: Aug 10, 2006 13:47:18.819755000 Time delta from previous packet: 0.017833000 seconds Time since reference or first frame: 0.170605000 seconds Frame Number: 8 Packet Length: 342 bytes Capture Length: 342 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:10:db:16:db:f6 (00:10:db:16:db:f6), Dst: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa) Destination: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa) Source: 00:10:db:16:db:f6 (00:10:db:16:db:f6) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.117 (165.227.249.117), Dst: 165.227.249.150 (165.227.249.150) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 328 Identification: 0x04d6 (1238) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0x35fc [correct] Good: True Bad : False Source: 165.227.249.117 (165.227.249.117) Destination: 165.227.249.150 (165.227.249.150) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 308 Checksum: 0xd1f7 [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0x04EAD57B2D8B5C17 Responder cookie: 0xA9A8DF1F354516A2 Next payload: Hash (8) Version: 1.0 Exchange type: Quick Mode (32) Flags .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0xB0806F15 Length: 300 Encrypted payload (272 bytes) 0000 00 0c 29 96 e1 fa 00 10 db 16 db f6 08 00 45 00 ..)...........E. 0010 01 48 04 d6 00 00 40 11 35 fc a5 e3 f9 75 a5 e3 .H....@.5....u.. 0020 f9 96 01 f4 01 f4 01 34 d1 f7 04 ea d5 7b 2d 8b .......4.....{-. 0030 5c 17 a9 a8 df 1f 35 45 16 a2 08 10 20 01 b0 80 \.....5E.... ... 0040 6f 15 00 00 01 2c bf 14 92 12 1f 7d c0 d7 81 b7 o....,.....}.... 0050 5a 00 5b 2e 36 0d ad c7 3e 2f 21 55 ab 96 0b b2 Z.[.6...>/!U.... 0060 2e a4 41 3d ff 3e 67 2f e5 9f c8 14 0e cf 10 52 ..A=.>g/.......R 0070 10 5e 1a 0d 5a 5b 90 47 35 c1 9d df 70 59 8c cd .^..Z[.G5...pY.. 0080 4e af dd 29 ae 7a c1 6e 7c 27 17 c1 63 34 ca 90 N..).z.n|'..c4.. 0090 00 70 75 fc bb 5e 18 70 f2 df f6 11 8e 18 be 1a .pu..^.p........ 00a0 65 9e 83 96 b4 d5 a6 38 0c 7f 0a 6f 1d a9 c5 80 e......8...o.... 00b0 88 fd 73 8d 0e 09 08 83 c9 d9 38 9a 9d 82 cd 0d ..s.......8..... 00c0 3e 0f af 5b f3 d0 30 d1 9a 5a 4a 15 7e 88 bf 6c >..[..0..ZJ.~..l 00d0 99 72 50 c0 b6 9c 19 53 4c 3e ec 07 9b 78 0f e8 .rP....SL>...x.. 00e0 7a f1 0a b5 c0 e0 7d 42 a3 2f 68 30 a3 57 92 fd z.....}B./h0.W.. 00f0 dd 02 c6 77 f7 2c 0a 64 a1 3b 58 e3 75 70 ac fe ...w.,.d.;X.up.. 0100 4c e6 7c 26 f6 24 54 bf 08 70 dd 4a 18 44 58 a0 L.|&.$T..p.J.DX. 0110 34 f7 04 13 23 90 84 08 5d da 3d 7f b9 64 fe 3d 4...#...].=..d.= 0120 29 40 4d be 47 bd e8 cc 15 ae 21 9e 27 a2 f4 99 )@M.G.....!.'... 0130 47 3e 30 02 f5 d2 49 07 9b 81 64 29 6d 7f 4b 03 G>0...I...d)m.K. 0140 58 6a 4f c4 f3 16 ee 18 a4 e8 3f 67 49 74 7e dd XjO.......?gIt~. 0150 69 86 07 2f 98 6c i../.l Frame 9 (102 bytes on wire, 102 bytes captured) Arrival Time: Aug 10, 2006 13:47:18.852560000 Time delta from previous packet: 0.032805000 seconds Time since reference or first frame: 0.203410000 seconds Frame Number: 9 Packet Length: 102 bytes Capture Length: 102 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa), Dst: 00:10:db:16:db:f6 (00:10:db:16:db:f6) Destination: 00:10:db:16:db:f6 (00:10:db:16:db:f6) Source: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.150 (165.227.249.150), Dst: 165.227.249.117 (165.227.249.117) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 88 Identification: 0x018a (394) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: UDP (0x11) Header checksum: 0xfa37 [correct] Good: True Bad : False Source: 165.227.249.150 (165.227.249.150) Destination: 165.227.249.117 (165.227.249.117) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 68 Checksum: 0x89f8 [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0x04EAD57B2D8B5C17 Responder cookie: 0xA9A8DF1F354516A2 Next payload: Hash (8) Version: 1.0 Exchange type: Quick Mode (32) Flags .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0xB0806F15 Length: 60 Encrypted payload (32 bytes) 0000 00 10 db 16 db f6 00 0c 29 96 e1 fa 08 00 45 00 ........).....E. 0010 00 58 01 8a 00 00 80 11 fa 37 a5 e3 f9 96 a5 e3 .X.......7...... 0020 f9 75 01 f4 01 f4 00 44 89 f8 04 ea d5 7b 2d 8b .u.....D.....{-. 0030 5c 17 a9 a8 df 1f 35 45 16 a2 08 10 20 01 b0 80 \.....5E.... ... 0040 6f 15 00 00 00 3c 0f a8 ac 7d 16 95 d9 dc 5d be o....<...}....]. 0050 d9 74 34 b4 34 e6 94 50 66 5b f5 2a 51 e4 c2 a0 .t4.4..Pf[.*Q... 0060 ec 83 42 18 31 b9 ..B.1. Frame 10 (398 bytes on wire, 398 bytes captured) Arrival Time: Aug 10, 2006 13:47:26.548709000 Time delta from previous packet: 7.696149000 seconds Time since reference or first frame: 7.899559000 seconds Frame Number: 10 Packet Length: 398 bytes Capture Length: 398 bytes Protocols in frame: eth:ip:esp:data Ethernet II, Src: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa), Dst: 00:10:db:16:db:f6 (00:10:db:16:db:f6) Destination: 00:10:db:16:db:f6 (00:10:db:16:db:f6) Source: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.150 (165.227.249.150), Dst: 165.227.249.117 (165.227.249.117) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 384 Identification: 0x018b (395) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: ESP (0x32) Header checksum: 0xf8ed [correct] Good: True Bad : False Source: 165.227.249.150 (165.227.249.150) Destination: 165.227.249.117 (165.227.249.117) Encapsulating Security Payload SPI: 0x7f07440b Sequence: 1 Data (356 bytes) 0000 00 10 db 16 db f6 00 0c 29 96 e1 fa 08 00 45 00 ........).....E. 0010 01 80 01 8b 00 00 80 32 f8 ed a5 e3 f9 96 a5 e3 .......2........ 0020 f9 75 7f 07 44 0b 00 00 00 01 bf 26 8b 44 cf 0d .u..D......&.D.. 0030 bb 1e 82 36 9c d0 d1 28 d0 e9 c8 9a e2 3b 02 f3 ...6...(.....;.. 0040 21 05 3e 64 63 b8 ac 22 f9 32 30 3c 8b c2 0d 8d !.>dc..".20<.... 0050 87 3f 39 29 c8 76 c1 d1 dd 92 be c3 a2 58 cf 3c .?9).v.......X.< 0060 7a fa 9c 55 b7 98 07 a9 f4 57 1c 10 a8 c8 fb 31 z..U.....W.....1 0070 5f a1 2a 6e b2 66 3d bf b2 17 a7 b5 60 47 9a d0 _.*n.f=.....`G.. 0080 b4 e4 2a 33 8d 9f 92 ac 75 52 26 0a 08 6b 6e 80 ..*3....uR&..kn. 0090 ea 55 de 1f f1 1f 65 f1 d3 ce 17 95 12 4b 1d 86 .U....e......K.. 00a0 ab cc e0 e6 6e 3a 46 fe e7 cf 66 a7 91 26 f1 d9 ....n:F...f..&.. 00b0 68 24 a2 83 10 c4 b8 90 09 0e 27 56 6a f8 21 fe h$........'Vj.!. 00c0 cd ba 70 c8 3b 5c 1c b4 f8 91 70 51 c9 d7 f0 c9 ..p.;\....pQ.... 00d0 2a 7e b5 ea f2 84 ca b4 fe 2b e9 19 d1 6c c3 3d *~.......+...l.= 00e0 e0 17 d3 d5 a4 c0 14 e5 79 fe 00 26 5b 4f e2 00 ........y..&[O.. 00f0 d8 04 f9 91 02 47 9d 6a 54 ca 9a 79 12 3c 0d a7 .....G.jT..y.<.. 0100 7b e7 cc b6 99 82 00 68 27 55 1a 2b 71 a6 37 32 {......h'U.+q.72 0110 7e f8 f9 0f bb 4d c3 b6 60 3a 08 1e e0 b9 c6 ad ~....M..`:...... 0120 b6 95 ad 5d 83 ca 3f 55 6c d0 bf 75 d2 76 56 0c ...]..?Ul..u.vV. 0130 ee 82 7b 58 e0 62 65 bd af 3f 6c 51 05 5f 92 9b ..{X.be..?lQ._.. 0140 71 e1 80 a6 80 af 11 1c 1d 4a a9 cb c1 e6 a5 f1 q........J...... 0150 b3 f9 c8 f6 87 46 45 49 4b 67 bb 6a 23 80 2c 42 .....FEIKg.j#.,B 0160 7e 84 5e 58 86 48 89 5a 7b 85 fc fc ab fe 36 de ~.^X.H.Z{.....6. 0170 bb 24 b3 f6 c3 ae 90 42 cb 60 31 c1 77 18 f8 10 .$.....B.`1.w... 0180 8f 52 6f 50 6d 8a 8c 5e cc 69 ba 88 aa a8 .RoPm..^.i.... Frame 11 (398 bytes on wire, 398 bytes captured) Arrival Time: Aug 10, 2006 13:47:26.557002000 Time delta from previous packet: 0.008293000 seconds Time since reference or first frame: 7.907852000 seconds Frame Number: 11 Packet Length: 398 bytes Capture Length: 398 bytes Protocols in frame: eth:ip:esp:data Ethernet II, Src: 00:10:db:16:db:f6 (00:10:db:16:db:f6), Dst: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa) Destination: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa) Source: 00:10:db:16:db:f6 (00:10:db:16:db:f6) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.117 (165.227.249.117), Dst: 165.227.249.150 (165.227.249.150) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 384 Identification: 0x04d8 (1240) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: ESP (0x32) Header checksum: 0x35a1 [correct] Good: True Bad : False Source: 165.227.249.117 (165.227.249.117) Destination: 165.227.249.150 (165.227.249.150) Encapsulating Security Payload SPI: 0x279b7aab Sequence: 1 Data (356 bytes) 0000 00 0c 29 96 e1 fa 00 10 db 16 db f6 08 00 45 00 ..)...........E. 0010 01 80 04 d8 00 00 40 32 35 a1 a5 e3 f9 75 a5 e3 ......@25....u.. 0020 f9 96 27 9b 7a ab 00 00 00 01 84 b2 d5 6b 50 c4 ..'.z........kP. 0030 fc 4a 50 5b e4 44 a1 af db 78 51 1a c2 86 12 4a .JP[.D...xQ....J 0040 1f eb 42 d6 0d 15 8e 5b c9 7f 33 69 b6 1a ef ce ..B....[..3i.... 0050 bd cf d7 a7 d3 7d 8a 52 92 2b 59 fa 5c 46 e3 fe .....}.R.+Y.\F.. 0060 38 f6 67 7b 0f 01 18 07 91 67 d7 13 bd bd 9f b3 8.g{.....g...... 0070 83 e2 e5 5b af 15 76 f0 e0 5e f2 6e eb 35 f2 dc ...[..v..^.n.5.. 0080 70 a4 7c c2 19 25 41 64 45 7c 66 f7 33 32 13 c7 p.|..%AdE|f.32.. 0090 fb bc 34 cb e1 5a 84 5a 49 83 e7 3f 77 2a ae af ..4..Z.ZI..?w*.. 00a0 44 68 22 77 fd 53 b9 8e 5c 1a 05 1d cd 4b fc aa Dh"w.S..\....K.. 00b0 4f 59 09 74 ca 46 cb c3 6c d8 6f 49 68 a2 ce bb OY.t.F..l.oIh... 00c0 ce 5e 2b bb 23 97 1e 58 75 12 99 fa ad 16 1d a6 .^+.#..Xu....... 00d0 98 60 c1 c9 15 14 e7 c4 bc 17 7a da 09 85 d6 e7 .`........z..... 00e0 a7 76 50 34 38 b5 90 ee 62 f1 d9 ee 8d 24 8f 38 .vP48...b....$.8 00f0 5c 90 71 37 fb 2f e0 5f 4b 8d 59 70 8d c3 08 7c \.q7./._K.Yp...| 0100 45 1e 4e a7 3a 73 02 61 63 c2 f6 85 01 25 f5 2d E.N.:s.ac....%.- 0110 5a 8e 61 20 13 bd e4 2a bf e9 14 5c cb 55 f5 a9 Z.a ...*...\.U.. 0120 3a 81 37 89 d8 8a a5 bc 6a 57 3b a3 b0 81 72 2f :.7.....jW;...r/ 0130 92 d0 6b db d6 0a 20 b0 2f d8 ef df 9c 50 4d 4f ..k... ./....PMO 0140 fa 08 5d 41 e6 d9 78 df 53 a1 f8 7f 13 fd 5f dc ..]A..x.S....._. 0150 24 2e 07 4b 5a 04 7d 4c ab 4b 82 8c a4 55 a0 2c $..KZ.}L.K...U., 0160 51 9e 0d 8e 85 0f b7 4e d9 bb 3b 8b d2 e1 19 4e Q......N..;....N 0170 8a e4 71 a1 29 42 d6 57 fe 34 f5 09 32 e7 a7 95 ..q.)B.W.4..2... 0180 f0 e7 e7 aa 46 cb f2 f5 08 af 4b 38 bf df ....F.....K8..