Frame 1 (222 bytes on wire, 222 bytes captured) Arrival Time: Aug 13, 2006 12:57:07.161354000 Time delta from previous packet: 0.000000000 seconds Time since reference or first frame: 0.000000000 seconds Frame Number: 1 Packet Length: 222 bytes Capture Length: 222 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa), Dst: 00:0c:29:f4:af:90 (00:0c:29:f4:af:90) Destination: 00:0c:29:f4:af:90 (00:0c:29:f4:af:90) Source: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.150 (165.227.249.150), Dst: 165.227.249.124 (165.227.249.124) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 208 Identification: 0x02c9 (713) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: UDP (0x11) Header checksum: 0xf879 [correct] Good: True Bad : False Source: 165.227.249.150 (165.227.249.150) Destination: 165.227.249.124 (165.227.249.124) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 188 Checksum: 0xc1ff [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0x4AFD59F361130E8E Responder cookie: 0x0000000000000000 Next payload: Security Association (1) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 180 Security Association payload Next payload: Vendor ID (13) Length: 52 Domain of interpretation: IPSEC (1) Situation: IDENTITY (1) Proposal payload # 1 Next payload: NONE (0) Length: 40 Proposal number: 1 Protocol ID: ISAKMP (1) SPI size: 0 Number of transforms: 1 Transform payload # 1 Next payload: NONE (0) Length: 32 Transform number: 1 Transform ID: KEY_IKE (1) Encryption-Algorithm (1): 3DES-CBC (5) Hash-Algorithm (2): SHA (2) Group-Description (4): Alternate 1024-bit MODP group (2) Authentication-Method (3): PSK (1) Life-Type (11): Seconds (1) Life-Duration (12): Duration-Value (28800) Vendor ID payload Next payload: Vendor ID (13) Length: 20 Vendor ID: unknown vendor ID: 0x4A131C81070358455C5728F20E95452F Vendor ID payload Next payload: Vendor ID (13) Length: 20 Vendor ID: draft-ietf-ipsec-nat-t-ike-03 Vendor ID payload Next payload: Vendor ID (13) Length: 20 Vendor ID: draft-ietf-ipsec-nat-t-ike-02 Vendor ID payload Next payload: Vendor ID (13) Length: 20 Vendor ID: draft-ietf-ipsec-nat-t-ike-00 Vendor ID payload Next payload: NONE (0) Length: 20 Vendor ID: RFC 3706 Detecting Dead IKE Peers (DPD) 0000 00 0c 29 f4 af 90 00 0c 29 96 e1 fa 08 00 45 00 ..).....).....E. 0010 00 d0 02 c9 00 00 80 11 f8 79 a5 e3 f9 96 a5 e3 .........y...... 0020 f9 7c 01 f4 01 f4 00 bc c1 ff 4a fd 59 f3 61 13 .|........J.Y.a. 0030 0e 8e 00 00 00 00 00 00 00 00 01 10 02 00 00 00 ................ 0040 00 00 00 00 00 b4 0d 00 00 34 00 00 00 01 00 00 .........4...... 0050 00 01 00 00 00 28 01 01 00 01 00 00 00 20 01 01 .....(....... .. 0060 00 00 80 01 00 05 80 02 00 02 80 04 00 02 80 03 ................ 0070 00 01 80 0b 00 01 80 0c 70 80 0d 00 00 14 4a 13 ........p.....J. 0080 1c 81 07 03 58 45 5c 57 28 f2 0e 95 45 2f 0d 00 ....XE\W(...E/.. 0090 00 14 7d 94 19 a6 53 10 ca 6f 2c 17 9d 92 15 52 ..}...S..o,....R 00a0 9d 56 0d 00 00 14 90 cb 80 91 3e bb 69 6e 08 63 .V........>.in.c 00b0 81 b5 ec 42 7b 1f 0d 00 00 14 44 85 15 2d 18 b6 ...B{.....D..-.. 00c0 bb cd 0b e8 a8 46 95 79 dd cc 00 00 00 14 af ca .....F.y........ 00d0 d7 13 68 a1 f1 c9 6b 86 96 fc 77 57 01 00 ..h...k...wW.. Frame 2 (262 bytes on wire, 262 bytes captured) Arrival Time: Aug 13, 2006 12:57:07.161356000 Time delta from previous packet: 0.000002000 seconds Time since reference or first frame: 0.000002000 seconds Frame Number: 2 Packet Length: 262 bytes Capture Length: 262 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:0c:29:f4:af:90 (00:0c:29:f4:af:90), Dst: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa) Destination: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa) Source: 00:0c:29:f4:af:90 (00:0c:29:f4:af:90) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.124 (165.227.249.124), Dst: 165.227.249.150 (165.227.249.150) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 248 Identification: 0x00ec (236) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0x3a2f [correct] Good: True Bad : False Source: 165.227.249.124 (165.227.249.124) Destination: 165.227.249.150 (165.227.249.150) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 228 Checksum: 0x1f01 [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0x4AFD59F361130E8E Responder cookie: 0x83DCAE09E498FDDD Next payload: Security Association (1) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 220 Security Association payload Next payload: Vendor ID (13) Length: 52 Domain of interpretation: IPSEC (1) Situation: IDENTITY (1) Proposal payload # 1 Next payload: NONE (0) Length: 40 Proposal number: 1 Protocol ID: ISAKMP (1) SPI size: 0 Number of transforms: 1 Transform payload # 1 Next payload: NONE (0) Length: 32 Transform number: 1 Transform ID: KEY_IKE (1) Encryption-Algorithm (1): 3DES-CBC (5) Hash-Algorithm (2): SHA (2) Group-Description (4): Alternate 1024-bit MODP group (2) Authentication-Method (3): PSK (1) Life-Type (11): Seconds (1) Life-Duration (12): Duration-Value (28800) Vendor ID payload Next payload: Vendor ID (13) Length: 20 Vendor ID: unknown vendor ID: 0x8F9CC94E01248ECDF147594C284B213B Vendor ID payload Next payload: Vendor ID (13) Length: 20 Vendor ID: draft-stenberg-ipsec-nat-traversal-01 Vendor ID payload Next payload: Vendor ID (13) Length: 20 Vendor ID: draft-stenberg-ipsec-nat-traversal-02 Vendor ID payload Next payload: Vendor ID (13) Length: 20 Vendor ID: draft-ietf-ipsec-nat-t-ike-00 Vendor ID payload Next payload: Vendor ID (13) Length: 20 Vendor ID: draft-ietf-ipsec-nat-t-ike-02 Vendor ID payload Next payload: Vendor ID (13) Length: 20 Vendor ID: draft-ietf-ipsec-nat-t-ike-02 Vendor ID payload Next payload: NONE (0) Length: 20 Vendor ID: draft-ietf-ipsec-nat-t-ike-03 0000 00 0c 29 96 e1 fa 00 0c 29 f4 af 90 08 00 45 00 ..).....).....E. 0010 00 f8 00 ec 00 00 40 11 3a 2f a5 e3 f9 7c a5 e3 ......@.:/...|.. 0020 f9 96 01 f4 01 f4 00 e4 1f 01 4a fd 59 f3 61 13 ..........J.Y.a. 0030 0e 8e 83 dc ae 09 e4 98 fd dd 01 10 02 00 00 00 ................ 0040 00 00 00 00 00 dc 0d 00 00 34 00 00 00 01 00 00 .........4...... 0050 00 01 00 00 00 28 01 01 00 01 00 00 00 20 01 01 .....(....... .. 0060 00 00 80 01 00 05 80 02 00 02 80 04 00 02 80 03 ................ 0070 00 01 80 0b 00 01 80 0c 70 80 0d 00 00 14 8f 9c ........p....... 0080 c9 4e 01 24 8e cd f1 47 59 4c 28 4b 21 3b 0d 00 .N.$...GYL(K!;.. 0090 00 14 27 ba b5 dc 01 ea 07 60 ea 4e 31 90 ac 27 ..'......`.N1..' 00a0 c0 d0 0d 00 00 14 61 05 c4 22 e7 68 47 e4 3f 96 ......a..".hG.?. 00b0 84 80 12 92 ae cd 0d 00 00 14 44 85 15 2d 18 b6 ..........D..-.. 00c0 bb cd 0b e8 a8 46 95 79 dd cc 0d 00 00 14 cd 60 .....F.y.......` 00d0 46 43 35 df 21 f8 7c fd b2 fc 68 b6 a4 48 0d 00 FC5.!.|...h..H.. 00e0 00 14 90 cb 80 91 3e bb 69 6e 08 63 81 b5 ec 42 ......>.in.c...B 00f0 7b 1f 00 00 00 14 7d 94 19 a6 53 10 ca 6f 2c 17 {.....}...S..o,. 0100 9d 92 15 52 9d 56 ...R.V Frame 3 (270 bytes on wire, 270 bytes captured) Arrival Time: Aug 13, 2006 12:57:07.188029000 Time delta from previous packet: 0.026673000 seconds Time since reference or first frame: 0.026675000 seconds Frame Number: 3 Packet Length: 270 bytes Capture Length: 270 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa), Dst: 00:0c:29:f4:af:90 (00:0c:29:f4:af:90) Destination: 00:0c:29:f4:af:90 (00:0c:29:f4:af:90) Source: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.150 (165.227.249.150), Dst: 165.227.249.124 (165.227.249.124) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 256 Identification: 0x02ca (714) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: UDP (0x11) Header checksum: 0xf848 [correct] Good: True Bad : False Source: 165.227.249.150 (165.227.249.150) Destination: 165.227.249.124 (165.227.249.124) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 236 Checksum: 0xe2ca [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0x4AFD59F361130E8E Responder cookie: 0x83DCAE09E498FDDD Next payload: Key Exchange (4) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 228 Key Exchange payload Next payload: Nonce (10) Length: 132 Key Exchange Data Nonce payload Next payload: NAT-D (draft-ietf-ipsec-nat-t-ike-01 to 03) (130) Length: 20 Nonce Data NAT-D (draft-ietf-ipsec-nat-t-ike-01 to 03) payload Next payload: NAT-D (draft-ietf-ipsec-nat-t-ike-01 to 03) (130) Length: 24 Hash of address and port: B756BB02CA217B4B6C31070A0817FE23BFC186CB NAT-D (draft-ietf-ipsec-nat-t-ike-01 to 03) payload Next payload: NONE (0) Length: 24 Hash of address and port: 6DBE535645F92AA9D066FAF25C326BF04BB64A31 0000 00 0c 29 f4 af 90 00 0c 29 96 e1 fa 08 00 45 00 ..).....).....E. 0010 01 00 02 ca 00 00 80 11 f8 48 a5 e3 f9 96 a5 e3 .........H...... 0020 f9 7c 01 f4 01 f4 00 ec e2 ca 4a fd 59 f3 61 13 .|........J.Y.a. 0030 0e 8e 83 dc ae 09 e4 98 fd dd 04 10 02 00 00 00 ................ 0040 00 00 00 00 00 e4 0a 00 00 84 09 09 62 2a 96 f9 ............b*.. 0050 9e 63 d3 ca 89 4b 4b d3 e1 d7 f6 b4 93 85 37 70 .c...KK.......7p 0060 b1 0d 65 fa 8a ba fa 47 82 44 e2 d2 2c ef c8 12 ..e....G.D..,... 0070 d5 e8 23 bd 32 5f 16 b2 30 ea 7a d1 41 d2 89 5b ..#.2_..0.z.A..[ 0080 3e 99 7f 96 42 03 5b 54 95 c6 3e 33 0a 35 b7 77 >...B.[T..>3.5.w 0090 3b 1b 1b c2 c4 7b f6 b0 bf bd 1e 85 47 19 6c 20 ;....{......G.l 00a0 2d fe 51 f1 97 02 8c 3a 84 65 79 3e 21 65 6e c6 -.Q....:.ey>!en. 00b0 57 82 86 29 e4 b2 74 78 32 08 ea 0b f2 be 99 4a W..)..tx2......J 00c0 9d d0 95 bf 90 d6 a5 ce 15 18 82 00 00 14 6a 52 ..............jR 00d0 ee 9d fa 1c 0b ee da e6 3d 22 bf f9 cf 43 82 00 ........="...C.. 00e0 00 18 b7 56 bb 02 ca 21 7b 4b 6c 31 07 0a 08 17 ...V...!{Kl1.... 00f0 fe 23 bf c1 86 cb 00 00 00 18 6d be 53 56 45 f9 .#........m.SVE. 0100 2a a9 d0 66 fa f2 5c 32 6b f0 4b b6 4a 31 *..f..\2k.K.J1 Frame 4 (270 bytes on wire, 270 bytes captured) Arrival Time: Aug 13, 2006 12:57:07.188031000 Time delta from previous packet: 0.000002000 seconds Time since reference or first frame: 0.026677000 seconds Frame Number: 4 Packet Length: 270 bytes Capture Length: 270 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:0c:29:f4:af:90 (00:0c:29:f4:af:90), Dst: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa) Destination: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa) Source: 00:0c:29:f4:af:90 (00:0c:29:f4:af:90) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.124 (165.227.249.124), Dst: 165.227.249.150 (165.227.249.150) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 256 Identification: 0x00ed (237) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0x3a26 [correct] Good: True Bad : False Source: 165.227.249.124 (165.227.249.124) Destination: 165.227.249.150 (165.227.249.150) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 236 Checksum: 0x0ae4 [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0x4AFD59F361130E8E Responder cookie: 0x83DCAE09E498FDDD Next payload: Key Exchange (4) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 228 Key Exchange payload Next payload: Nonce (10) Length: 132 Key Exchange Data Nonce payload Next payload: NAT-D (draft-ietf-ipsec-nat-t-ike-01 to 03) (130) Length: 20 Nonce Data NAT-D (draft-ietf-ipsec-nat-t-ike-01 to 03) payload Next payload: NAT-D (draft-ietf-ipsec-nat-t-ike-01 to 03) (130) Length: 24 Hash of address and port: 6DBE535645F92AA9D066FAF25C326BF04BB64A31 NAT-D (draft-ietf-ipsec-nat-t-ike-01 to 03) payload Next payload: NONE (0) Length: 24 Hash of address and port: B756BB02CA217B4B6C31070A0817FE23BFC186CB 0000 00 0c 29 96 e1 fa 00 0c 29 f4 af 90 08 00 45 00 ..).....).....E. 0010 01 00 00 ed 00 00 40 11 3a 26 a5 e3 f9 7c a5 e3 ......@.:&...|.. 0020 f9 96 01 f4 01 f4 00 ec 0a e4 4a fd 59 f3 61 13 ..........J.Y.a. 0030 0e 8e 83 dc ae 09 e4 98 fd dd 04 10 02 00 00 00 ................ 0040 00 00 00 00 00 e4 0a 00 00 84 f1 14 e7 bd 3c 67 ............... 0070 bd db 06 19 a8 d8 1d 0e 66 d0 be 99 57 1e 98 f1 ........f...W... 0080 6a e1 9f 87 1e 07 4d 91 81 82 da 90 30 41 j.....M.....0A Frame 6 (110 bytes on wire, 110 bytes captured) Arrival Time: Aug 13, 2006 12:57:07.275998000 Time delta from previous packet: 0.004976000 seconds Time since reference or first frame: 0.114644000 seconds Frame Number: 6 Packet Length: 110 bytes Capture Length: 110 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:0c:29:f4:af:90 (00:0c:29:f4:af:90), Dst: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa) Destination: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa) Source: 00:0c:29:f4:af:90 (00:0c:29:f4:af:90) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.124 (165.227.249.124), Dst: 165.227.249.150 (165.227.249.150) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 96 Identification: 0x00ee (238) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0x3ac5 [correct] Good: True Bad : False Source: 165.227.249.124 (165.227.249.124) Destination: 165.227.249.150 (165.227.249.150) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 76 Checksum: 0x794f [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0x4AFD59F361130E8E Responder cookie: 0x83DCAE09E498FDDD Next payload: Identification (5) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 68 Encrypted payload (40 bytes) 0000 00 0c 29 96 e1 fa 00 0c 29 f4 af 90 08 00 45 00 ..).....).....E. 0010 00 60 00 ee 00 00 40 11 3a c5 a5 e3 f9 7c a5 e3 .`....@.:....|.. 0020 f9 96 01 f4 01 f4 00 4c 79 4f 4a fd 59 f3 61 13 .......LyOJ.Y.a. 0030 0e 8e 83 dc ae 09 e4 98 fd dd 05 10 02 01 00 00 ................ 0040 00 00 00 00 00 44 09 2b 82 43 c8 d3 9b 9d 2b ac .....D.+.C....+. 0050 55 72 6a 86 d7 c6 13 76 4e a7 a5 7e 1d 98 22 41 Urj....vN..~.."A 0060 84 c3 9c 34 96 ee 2c d6 7a f5 fd 43 bb 48 ...4..,.z..C.H Frame 7 (334 bytes on wire, 334 bytes captured) Arrival Time: Aug 13, 2006 12:57:07.301679000 Time delta from previous packet: 0.025681000 seconds Time since reference or first frame: 0.140325000 seconds Frame Number: 7 Packet Length: 334 bytes Capture Length: 334 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa), Dst: 00:0c:29:f4:af:90 (00:0c:29:f4:af:90) Destination: 00:0c:29:f4:af:90 (00:0c:29:f4:af:90) Source: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.150 (165.227.249.150), Dst: 165.227.249.124 (165.227.249.124) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 320 Identification: 0x02cc (716) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: UDP (0x11) Header checksum: 0xf806 [correct] Good: True Bad : False Source: 165.227.249.150 (165.227.249.150) Destination: 165.227.249.124 (165.227.249.124) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 300 Checksum: 0xf40b [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0x4AFD59F361130E8E Responder cookie: 0x83DCAE09E498FDDD Next payload: Hash (8) Version: 1.0 Exchange type: Quick Mode (32) Flags .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x44F42061 Length: 292 Encrypted payload (264 bytes) 0000 00 0c 29 f4 af 90 00 0c 29 96 e1 fa 08 00 45 00 ..).....).....E. 0010 01 40 02 cc 00 00 80 11 f8 06 a5 e3 f9 96 a5 e3 .@.............. 0020 f9 7c 01 f4 01 f4 01 2c f4 0b 4a fd 59 f3 61 13 .|.....,..J.Y.a. 0030 0e 8e 83 dc ae 09 e4 98 fd dd 08 10 20 01 44 f4 ............ .D. 0040 20 61 00 00 01 24 f7 fe b7 36 1b be 1e ef 8b 9d a...$...6...... 0050 01 3c 83 e8 dc 4f 58 90 27 ef a2 1c 3a 3f 4f dd .<...OX.'...:?O. 0060 a2 24 f2 56 da 5f ba 4d 65 2b b6 87 f4 70 ca 6a .$.V._.Me+...p.j 0070 fc 16 ee 13 8c 3e 37 f8 ae 49 b3 ee 7e 3e b7 c3 .....>7..I..~>.. 0080 3e 1f 69 2a 39 aa 15 77 f9 64 70 e6 cf 4d fe fe >.i*9..w.dp..M.. 0090 95 3c 09 46 5a 89 6d 63 7a 3d de 67 66 19 94 ff .<.FZ.mcz=.gf... 00a0 14 b9 17 ad 9b e1 aa 89 77 3b 89 6c ca 72 94 52 ........w;.l.r.R 00b0 6b 0a 5c 9b 53 f5 9a b4 a0 57 fc 2a 11 3b 3f f7 k.\.S....W.*.;?. 00c0 c5 6e b7 de 87 d8 18 ba 0b 6c 8f 06 d6 48 d8 4a .n.......l...H.J 00d0 1f 43 a9 21 02 1e 1a a4 00 3a 46 5b e5 04 fd fd .C.!.....:F[.... 00e0 15 a7 90 ce 44 f6 e4 79 ac 56 e4 b7 a8 5f be 81 ....D..y.V..._.. 00f0 d3 6d 6a df 7c 35 f8 32 89 eb e1 3a 37 e7 a0 2f .mj.|5.2...:7../ 0100 fc ef 11 f9 30 81 f8 22 d4 2c 3f 8a 5c 89 02 86 ....0..".,?.\... 0110 6c 9c 75 b8 9b 28 ea d7 c3 41 c4 ea 55 b0 83 27 l.u..(...A..U..' 0120 0a ef f7 e1 b4 d7 7e 59 75 a8 53 ba dc 48 70 c5 ......~Yu.S..Hp. 0130 46 a2 b7 19 5c e7 7d 1b 96 f2 2e 77 e1 86 5b a0 F...\.}....w..[. 0140 b1 82 30 4d c5 ec 04 23 66 fb 9d 1a 64 03 ..0M...#f...d. Frame 8 (326 bytes on wire, 326 bytes captured) Arrival Time: Aug 13, 2006 12:57:07.301681000 Time delta from previous packet: 0.000002000 seconds Time since reference or first frame: 0.140327000 seconds Frame Number: 8 Packet Length: 326 bytes Capture Length: 326 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:0c:29:f4:af:90 (00:0c:29:f4:af:90), Dst: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa) Destination: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa) Source: 00:0c:29:f4:af:90 (00:0c:29:f4:af:90) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.124 (165.227.249.124), Dst: 165.227.249.150 (165.227.249.150) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 312 Identification: 0x00ef (239) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0x39ec [correct] Good: True Bad : False Source: 165.227.249.124 (165.227.249.124) Destination: 165.227.249.150 (165.227.249.150) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 292 Checksum: 0x77e0 [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0x4AFD59F361130E8E Responder cookie: 0x83DCAE09E498FDDD Next payload: Hash (8) Version: 1.0 Exchange type: Quick Mode (32) Flags .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x44F42061 Length: 284 Encrypted payload (256 bytes) 0000 00 0c 29 96 e1 fa 00 0c 29 f4 af 90 08 00 45 00 ..).....).....E. 0010 01 38 00 ef 00 00 40 11 39 ec a5 e3 f9 7c a5 e3 .8....@.9....|.. 0020 f9 96 01 f4 01 f4 01 24 77 e0 4a fd 59 f3 61 13 .......$w.J.Y.a. 0030 0e 8e 83 dc ae 09 e4 98 fd dd 08 10 20 01 44 f4 ............ .D. 0040 20 61 00 00 01 1c 9c 46 84 03 d8 0c c7 35 6c 4f a.....F.....5lO 0050 a7 b4 b1 bd cb 8b df a9 a9 65 33 d5 79 41 a0 c8 .........e3.yA.. 0060 80 e9 53 9a 1d 41 85 0e f3 e2 4e 5a 39 96 60 ea ..S..A....NZ9.`. 0070 35 93 22 83 21 86 15 b2 b7 42 89 fe 4a 6f 98 fa 5.".!....B..Jo.. 0080 25 59 fb e6 42 6d 27 ad dd b9 3a 3a 94 37 d0 da %Y..Bm'...::.7.. 0090 41 9c 1a 9b f2 1c da 3e 94 c3 c5 ff ee a4 c5 33 A......>.......3 00a0 b9 6f 4e 6a b2 d5 be a3 07 c7 93 20 d9 53 be 9e .oNj....... .S.. 00b0 c3 16 59 3f a0 f0 6e b3 3e c8 e8 c0 62 00 7b 65 ..Y?..n.>...b.{e 00c0 ba c1 35 36 4b 76 49 4f f8 42 de 20 e5 66 d4 f4 ..56KvIO.B. .f.. 00d0 97 a1 82 3e 4a ef 4e 47 67 2d 52 94 33 eb 82 05 ...>J.NGg-R.3... 00e0 62 6b 00 42 01 7f 6f 41 b1 79 6c ff 44 71 df 5f bk.B..oA.yl.Dq._ 00f0 1d 2d 5b 3c bb 5b 3b c5 09 fe d3 41 6e ca 1b 55 .-[<.[;....An..U 0100 e3 c0 be db 56 28 91 91 05 1f 2a de 4a 55 0f cc ....V(....*.JU.. 0110 0f 04 20 53 72 0e c2 af 75 76 8a ba 4d fc b7 11 .. Sr...uv..M... 0120 fe ba 90 03 57 15 b2 45 83 8b 7d c6 c4 40 2a 9a ....W..E..}..@*. 0130 69 a4 5b a9 af 03 78 b2 28 39 ad 2b 70 0b 7b d3 i.[...x.(9.+p.{. 0140 a3 d6 4c 16 76 69 ..L.vi Frame 9 (102 bytes on wire, 102 bytes captured) Arrival Time: Aug 13, 2006 12:57:07.371781000 Time delta from previous packet: 0.070100000 seconds Time since reference or first frame: 0.210427000 seconds Frame Number: 9 Packet Length: 102 bytes Capture Length: 102 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa), Dst: 00:0c:29:f4:af:90 (00:0c:29:f4:af:90) Destination: 00:0c:29:f4:af:90 (00:0c:29:f4:af:90) Source: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.150 (165.227.249.150), Dst: 165.227.249.124 (165.227.249.124) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 88 Identification: 0x02cd (717) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: UDP (0x11) Header checksum: 0xf8ed [correct] Good: True Bad : False Source: 165.227.249.150 (165.227.249.150) Destination: 165.227.249.124 (165.227.249.124) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 68 Checksum: 0xf0bb [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0x4AFD59F361130E8E Responder cookie: 0x83DCAE09E498FDDD Next payload: Hash (8) Version: 1.0 Exchange type: Quick Mode (32) Flags .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x44F42061 Length: 60 Encrypted payload (32 bytes) 0000 00 0c 29 f4 af 90 00 0c 29 96 e1 fa 08 00 45 00 ..).....).....E. 0010 00 58 02 cd 00 00 80 11 f8 ed a5 e3 f9 96 a5 e3 .X.............. 0020 f9 7c 01 f4 01 f4 00 44 f0 bb 4a fd 59 f3 61 13 .|.....D..J.Y.a. 0030 0e 8e 83 dc ae 09 e4 98 fd dd 08 10 20 01 44 f4 ............ .D. 0040 20 61 00 00 00 3c 8e 74 9f 26 50 72 23 02 c8 98 a...<.t.&Pr#... 0050 2e ff aa ce 4f e7 bb af 89 60 c8 58 e8 6a 65 45 ....O....`.X.jeE 0060 88 b1 bf 4c de e0 ...L.. Frame 10 (398 bytes on wire, 398 bytes captured) Arrival Time: Aug 13, 2006 12:57:14.249353000 Time delta from previous packet: 6.877572000 seconds Time since reference or first frame: 7.087999000 seconds Frame Number: 10 Packet Length: 398 bytes Capture Length: 398 bytes Protocols in frame: eth:ip:esp:data Ethernet II, Src: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa), Dst: 00:0c:29:f4:af:90 (00:0c:29:f4:af:90) Destination: 00:0c:29:f4:af:90 (00:0c:29:f4:af:90) Source: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.150 (165.227.249.150), Dst: 165.227.249.124 (165.227.249.124) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 384 Identification: 0x02ce (718) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: ESP (0x32) Header checksum: 0xf7a3 [correct] Good: True Bad : False Source: 165.227.249.150 (165.227.249.150) Destination: 165.227.249.124 (165.227.249.124) Encapsulating Security Payload SPI: 0x9a74c790 Sequence: 1 Data (356 bytes) 0000 00 0c 29 f4 af 90 00 0c 29 96 e1 fa 08 00 45 00 ..).....).....E. 0010 01 80 02 ce 00 00 80 32 f7 a3 a5 e3 f9 96 a5 e3 .......2........ 0020 f9 7c 9a 74 c7 90 00 00 00 01 56 db f1 2e 86 f2 .|.t......V..... 0030 22 0e 7e 11 fe 60 75 d6 8e 62 15 08 87 3e 40 38 ".~..`u..b...>@8 0040 35 8a 2e 92 4a 47 a3 a5 3a fc d8 c9 fc 8d 4a df 5...JG..:.....J. 0050 20 b3 bb e4 16 58 54 00 ce 78 a9 c0 17 f0 5a b5 ....XT..x....Z. 0060 11 9f 12 fa 8b d4 d6 53 27 65 fd b0 75 55 97 8e .......S'e..uU.. 0070 81 af 69 08 c9 39 77 d2 b7 ed 65 49 78 7a 2e 66 ..i..9w...eIxz.f 0080 1f 34 52 7f 85 7d ae 03 4f ae 94 ec 46 03 96 1f .4R..}..O...F... 0090 65 7d 52 c6 d5 d3 eb 96 6f b3 2c 22 45 de 21 8f e}R.....o.,"E.!. 00a0 6a 84 dd 22 79 11 be fd b8 8c ce 47 e1 09 82 2a j.."y......G...* 00b0 25 a0 71 90 8b 40 94 ee a9 97 1b e8 4e 8f 8c 4e %.q..@......N..N 00c0 c1 bb 97 e3 00 49 fa 21 ee 4c 51 63 10 d4 97 3a .....I.!.LQc...: 00d0 71 4b e1 98 cc b2 84 42 18 b8 52 29 df d7 e6 c8 qK.....B..R).... 00e0 9e f8 67 13 73 5b 30 bd 25 e7 d2 7f 4b 74 20 fa ..g.s[0.%...Kt . 00f0 50 44 5c 13 78 72 d0 9f 2e fb c7 7b c8 bb 6b 8d PD\.xr.....{..k. 0100 7e 9f ae 3e c2 ba c3 76 f5 ea da 3d 9d 62 3d 34 ~..>...v...=.b=4 0110 93 96 9c 0d 65 23 45 6a 05 e8 e6 33 d9 02 19 c7 ....e#Ej...3.... 0120 cd 2d 9a 93 08 69 ca 4d 23 64 27 6f 70 d5 41 e1 .-...i.M#d'op.A. 0130 43 26 99 1c 7d 39 92 23 c7 5c 89 00 fa 59 13 a7 C&..}9.#.\...Y.. 0140 6f 8f 4f d2 c8 10 5c c9 0f 31 bf 7f 79 20 f4 dc o.O...\..1..y .. 0150 a5 7d b2 67 c8 2b a2 59 99 d4 b6 c8 28 a3 ce b1 .}.g.+.Y....(... 0160 e4 9f e2 9b 58 5e 19 10 b1 ef 4d e3 4c c5 06 a0 ....X^....M.L... 0170 db 9b 83 bd f5 70 82 e9 66 ff c5 27 64 e8 36 bd .....p..f..'d.6. 0180 58 92 1b 22 fc 66 d3 af ea 36 36 d8 2a 6c X..".f...66.*l Frame 11 (398 bytes on wire, 398 bytes captured) Arrival Time: Aug 13, 2006 12:57:14.279966000 Time delta from previous packet: 0.030613000 seconds Time since reference or first frame: 7.118612000 seconds Frame Number: 11 Packet Length: 398 bytes Capture Length: 398 bytes Protocols in frame: eth:ip:esp:data Ethernet II, Src: 00:0c:29:f4:af:90 (00:0c:29:f4:af:90), Dst: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa) Destination: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa) Source: 00:0c:29:f4:af:90 (00:0c:29:f4:af:90) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.124 (165.227.249.124), Dst: 165.227.249.150 (165.227.249.150) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 384 Identification: 0x001d (29) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 240 Protocol: ESP (0x32) Header checksum: 0x8a54 [correct] Good: True Bad : False Source: 165.227.249.124 (165.227.249.124) Destination: 165.227.249.150 (165.227.249.150) Encapsulating Security Payload SPI: 0x4207edd6 Sequence: 2 Data (356 bytes) 0000 00 0c 29 96 e1 fa 00 0c 29 f4 af 90 08 00 45 00 ..).....).....E. 0010 01 80 00 1d 00 00 f0 32 8a 54 a5 e3 f9 7c a5 e3 .......2.T...|.. 0020 f9 96 42 07 ed d6 00 00 00 02 3a 88 b1 69 e5 a4 ..B.......:..i.. 0030 ff 1d 74 74 a6 e3 27 40 d9 83 b2 b6 4b 16 ec 5f ..tt..'@....K.._ 0040 be 82 8f 01 c4 36 c5 4b 30 d6 99 d5 4e 69 1b a6 .....6.K0...Ni.. 0050 73 c6 8d 57 87 a5 0b c4 32 12 04 9f ba 70 fd 9e s..W....2....p.. 0060 cb f2 da 3c 2c 6c 8b 19 bd 45 4c 8a ac e7 5a 92 ...<,l...EL...Z. 0070 02 5c 2d 98 9f 5c 65 15 fd e5 fb 15 92 ad be 2b .\-..\e........+ 0080 49 81 05 9d 99 e9 f2 d4 c7 93 4a 7c 5e 5d fb 0b I.........J|^].. 0090 f4 90 14 9a b4 ea 6a de dc d4 c4 cb 2d 96 bc 14 ......j.....-... 00a0 2a af c9 5f ec dc d1 a9 f3 be 33 b2 dd 7c a8 36 *.._......3..|.6 00b0 32 16 77 f1 b5 bc e2 a2 1b a1 0d 14 c7 23 0a c8 2.w..........#.. 00c0 3f 36 7a 04 d7 c3 29 55 fd cc c5 9b 9f fa 07 cb ?6z...)U........ 00d0 be 79 74 0b 4d f0 90 5e 8c 5f 41 78 5b c0 d6 9d .yt.M..^._Ax[... 00e0 72 9f 35 ce e5 bc d2 d2 f3 6e 7c f2 3e 46 7e d8 r.5......n|.>F~. 00f0 1f fc 25 53 67 e3 84 58 56 14 e0 cc e9 94 f2 db ..%Sg..XV....... 0100 27 8a 70 3f 39 86 86 aa 11 a2 61 fc ef fe e8 90 '.p?9.....a..... 0110 c1 1a a6 3a 02 34 03 42 40 52 e2 70 c3 b4 d2 0b ...:.4.B@R.p.... 0120 f9 62 08 0e 7f 7e 01 3c 1d 45 60 c5 bb fe d6 7d .b...~.<.E`....} 0130 38 34 6d 84 76 8f b0 b1 52 ba 6e 2d 5d d5 07 bb 84m.v...R.n-]... 0140 5a c7 0f d4 a4 59 88 bb b1 85 0a f6 f6 5c 93 cd Z....Y.......\.. 0150 51 d2 69 86 96 fa cb d5 89 1c 47 ee cd 83 4e 0a Q.i.......G...N. 0160 82 37 bb d9 6e 88 80 d1 23 58 90 44 f7 d5 7f aa .7..n...#X.D.... 0170 cb 35 32 46 00 08 c0 50 4f 81 db aa b3 43 de b1 .52F...PO....C.. 0180 37 ac 2c c0 f2 9e ac b1 6a e4 55 6e 2b 9a 7.,.....j.Un+.