Frame 1 (222 bytes on wire, 222 bytes captured) Arrival Time: Aug 10, 2006 13:52:11.466224000 Time delta from previous packet: 0.000000000 seconds Time since reference or first frame: 0.000000000 seconds Frame Number: 1 Packet Length: 222 bytes Capture Length: 222 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa), Dst: 00:05:00:b8:00:e0 (00:05:00:b8:00:e0) Destination: 00:05:00:b8:00:e0 (00:05:00:b8:00:e0) Source: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.150 (165.227.249.150), Dst: 165.227.249.126 (165.227.249.126) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 208 Identification: 0x01a5 (421) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: UDP (0x11) Header checksum: 0xf99b [correct] Good: True Bad : False Source: 165.227.249.150 (165.227.249.150) Destination: 165.227.249.126 (165.227.249.126) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 188 Checksum: 0xd64d [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0xF25AB8560BBA49D6 Responder cookie: 0x0000000000000000 Next payload: Security Association (1) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 180 Security Association payload Next payload: Vendor ID (13) Length: 52 Domain of interpretation: IPSEC (1) Situation: IDENTITY (1) Proposal payload # 1 Next payload: NONE (0) Length: 40 Proposal number: 1 Protocol ID: ISAKMP (1) SPI size: 0 Number of transforms: 1 Transform payload # 1 Next payload: NONE (0) Length: 32 Transform number: 1 Transform ID: KEY_IKE (1) Encryption-Algorithm (1): 3DES-CBC (5) Hash-Algorithm (2): SHA (2) Group-Description (4): Alternate 1024-bit MODP group (2) Authentication-Method (3): PSK (1) Life-Type (11): Seconds (1) Life-Duration (12): Duration-Value (28800) Vendor ID payload Next payload: Vendor ID (13) Length: 20 Vendor ID: unknown vendor ID: 0x4A131C81070358455C5728F20E95452F Vendor ID payload Next payload: Vendor ID (13) Length: 20 Vendor ID: draft-ietf-ipsec-nat-t-ike-03 Vendor ID payload Next payload: Vendor ID (13) Length: 20 Vendor ID: draft-ietf-ipsec-nat-t-ike-02 Vendor ID payload Next payload: Vendor ID (13) Length: 20 Vendor ID: draft-ietf-ipsec-nat-t-ike-00 Vendor ID payload Next payload: NONE (0) Length: 20 Vendor ID: RFC 3706 Detecting Dead IKE Peers (DPD) 0000 00 05 00 b8 00 e0 00 0c 29 96 e1 fa 08 00 45 00 ........).....E. 0010 00 d0 01 a5 00 00 80 11 f9 9b a5 e3 f9 96 a5 e3 ................ 0020 f9 7e 01 f4 01 f4 00 bc d6 4d f2 5a b8 56 0b ba .~.......M.Z.V.. 0030 49 d6 00 00 00 00 00 00 00 00 01 10 02 00 00 00 I............... 0040 00 00 00 00 00 b4 0d 00 00 34 00 00 00 01 00 00 .........4...... 0050 00 01 00 00 00 28 01 01 00 01 00 00 00 20 01 01 .....(....... .. 0060 00 00 80 01 00 05 80 02 00 02 80 04 00 02 80 03 ................ 0070 00 01 80 0b 00 01 80 0c 70 80 0d 00 00 14 4a 13 ........p.....J. 0080 1c 81 07 03 58 45 5c 57 28 f2 0e 95 45 2f 0d 00 ....XE\W(...E/.. 0090 00 14 7d 94 19 a6 53 10 ca 6f 2c 17 9d 92 15 52 ..}...S..o,....R 00a0 9d 56 0d 00 00 14 90 cb 80 91 3e bb 69 6e 08 63 .V........>.in.c 00b0 81 b5 ec 42 7b 1f 0d 00 00 14 44 85 15 2d 18 b6 ...B{.....D..-.. 00c0 bb cd 0b e8 a8 46 95 79 dd cc 00 00 00 14 af ca .....F.y........ 00d0 d7 13 68 a1 f1 c9 6b 86 96 fc 77 57 01 00 ..h...k...wW.. Frame 2 (146 bytes on wire, 146 bytes captured) Arrival Time: Aug 10, 2006 13:52:11.637138000 Time delta from previous packet: 0.170914000 seconds Time since reference or first frame: 0.170914000 seconds Frame Number: 2 Packet Length: 146 bytes Capture Length: 146 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:05:00:b8:00:e0 (00:05:00:b8:00:e0), Dst: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa) Destination: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa) Source: 00:05:00:b8:00:e0 (00:05:00:b8:00:e0) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.126 (165.227.249.126), Dst: 165.227.249.150 (165.227.249.150) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 132 Identification: 0xde36 (56886) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: UDP (0x11) Header checksum: 0x1d56 [correct] Good: True Bad : False Source: 165.227.249.126 (165.227.249.126) Destination: 165.227.249.150 (165.227.249.150) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 112 Checksum: 0x4f4a [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0xF25AB8560BBA49D6 Responder cookie: 0x3C094F0D9696EFDD Next payload: Security Association (1) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 104 Security Association payload Next payload: Vendor ID (13) Length: 52 Domain of interpretation: IPSEC (1) Situation: IDENTITY (1) Proposal payload # 1 Next payload: NONE (0) Length: 40 Proposal number: 1 Protocol ID: ISAKMP (1) SPI size: 0 Number of transforms: 1 Transform payload # 1 Next payload: NONE (0) Length: 32 Transform number: 1 Transform ID: KEY_IKE (1) Encryption-Algorithm (1): 3DES-CBC (5) Hash-Algorithm (2): SHA (2) Group-Description (4): Alternate 1024-bit MODP group (2) Authentication-Method (3): PSK (1) Life-Type (11): Seconds (1) Life-Duration (12): Duration-Value (28800) Vendor ID payload Next payload: NONE (0) Length: 24 Vendor ID: Microsoft L2TP/IPSec VPN Client 0000 00 0c 29 96 e1 fa 00 05 00 b8 00 e0 08 00 45 00 ..)...........E. 0010 00 84 de 36 00 00 80 11 1d 56 a5 e3 f9 7e a5 e3 ...6.....V...~.. 0020 f9 96 01 f4 01 f4 00 70 4f 4a f2 5a b8 56 0b ba .......pOJ.Z.V.. 0030 49 d6 3c 09 4f 0d 96 96 ef dd 01 10 02 00 00 00 I.<.O........... 0040 00 00 00 00 00 68 0d 00 00 34 00 00 00 01 00 00 .....h...4...... 0050 00 01 00 00 00 28 01 01 00 01 00 00 00 20 01 01 .....(....... .. 0060 00 00 80 01 00 05 80 02 00 02 80 04 00 02 80 03 ................ 0070 00 01 80 0b 00 01 80 0c 70 80 00 00 00 18 40 48 ........p.....@H 0080 b7 d5 6e bc e8 85 25 e7 de 7f 00 d6 c2 d3 c0 00 ..n...%......... 0090 00 00 .. Frame 3 (222 bytes on wire, 222 bytes captured) Arrival Time: Aug 10, 2006 13:52:11.650770000 Time delta from previous packet: 0.013632000 seconds Time since reference or first frame: 0.184546000 seconds Frame Number: 3 Packet Length: 222 bytes Capture Length: 222 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa), Dst: 00:05:00:b8:00:e0 (00:05:00:b8:00:e0) Destination: 00:05:00:b8:00:e0 (00:05:00:b8:00:e0) Source: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.150 (165.227.249.150), Dst: 165.227.249.126 (165.227.249.126) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 208 Identification: 0x01a6 (422) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: UDP (0x11) Header checksum: 0xf99a [correct] Good: True Bad : False Source: 165.227.249.150 (165.227.249.150) Destination: 165.227.249.126 (165.227.249.126) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 188 Checksum: 0x8e6f [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0xF25AB8560BBA49D6 Responder cookie: 0x3C094F0D9696EFDD Next payload: Key Exchange (4) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 180 Key Exchange payload Next payload: Nonce (10) Length: 132 Key Exchange Data Nonce payload Next payload: NONE (0) Length: 20 Nonce Data 0000 00 05 00 b8 00 e0 00 0c 29 96 e1 fa 08 00 45 00 ........).....E. 0010 00 d0 01 a6 00 00 80 11 f9 9a a5 e3 f9 96 a5 e3 ................ 0020 f9 7e 01 f4 01 f4 00 bc 8e 6f f2 5a b8 56 0b ba .~.......o.Z.V.. 0030 49 d6 3c 09 4f 0d 96 96 ef dd 04 10 02 00 00 00 I.<.O........... 0040 00 00 00 00 00 b4 0a 00 00 84 69 20 59 7a 54 91 ..........i YzT. 0050 c2 b8 74 c3 e4 27 cc e8 07 fb f7 f3 e5 05 05 4b ..t..'.........K 0060 26 7a 20 ed a3 ad fc 90 ca 09 80 24 2c 83 74 b3 &z ........$,.t. 0070 b0 ac f4 d7 71 ba 8c 9c 24 23 27 5d 80 df 7b 6c ....q...$#']..{l 0080 ac 86 ae 2a c8 04 c7 0a 24 c9 c4 f2 9a 31 17 f7 ...*....$....1.. 0090 2d 6b fc 46 2f ac 11 eb f0 e2 1b 66 42 15 68 b8 -k.F/......fB.h. 00a0 95 ff 61 61 48 bd 7f ac 08 8b c4 00 b0 c4 b9 f5 ..aaH........... 00b0 99 fd d1 7d b9 c9 5d c8 4a ae aa 68 9f 9e 86 27 ...}..].J..h...' 00c0 cc 82 74 9a 15 f4 5b cd 15 d3 00 00 00 14 a5 b6 ..t...[......... 00d0 de b7 79 dc 3e c7 4c a6 ad d2 98 20 8c 0e ..y.>.L.... .. Frame 4 (298 bytes on wire, 298 bytes captured) Arrival Time: Aug 10, 2006 13:52:11.773533000 Time delta from previous packet: 0.122763000 seconds Time since reference or first frame: 0.307309000 seconds Frame Number: 4 Packet Length: 298 bytes Capture Length: 298 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:05:00:b8:00:e0 (00:05:00:b8:00:e0), Dst: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa) Destination: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa) Source: 00:05:00:b8:00:e0 (00:05:00:b8:00:e0) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.126 (165.227.249.126), Dst: 165.227.249.150 (165.227.249.150) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 284 Identification: 0x8fe6 (36838) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: UDP (0x11) Header checksum: 0x6b0e [correct] Good: True Bad : False Source: 165.227.249.126 (165.227.249.126) Destination: 165.227.249.150 (165.227.249.150) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 264 Checksum: 0xb312 [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0xF25AB8560BBA49D6 Responder cookie: 0x3C094F0D9696EFDD Next payload: Key Exchange (4) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 256 Key Exchange payload Next payload: Nonce (10) Length: 132 Key Exchange Data Nonce payload Next payload: Vendor ID (13) Length: 24 Nonce Data Vendor ID payload Next payload: Vendor ID (13) Length: 20 Vendor ID: unknown vendor ID: 0x12F5F28C457168A9702D9FE274CC0100 Vendor ID payload Next payload: Vendor ID (13) Length: 12 Vendor ID: draft-beaulieu-ike-xauth-02.txt Vendor ID payload Next payload: Vendor ID (13) Length: 20 Vendor ID: unknown vendor ID: 0xC9CEE8109697EFDD1FADC55FA3F4B28C Vendor ID payload Next payload: NONE (0) Length: 20 Vendor ID: unknown vendor ID: 0x1F07F70EAA6514D3B0FA96542A500407 0000 00 0c 29 96 e1 fa 00 05 00 b8 00 e0 08 00 45 00 ..)...........E. 0010 01 1c 8f e6 00 00 80 11 6b 0e a5 e3 f9 7e a5 e3 ........k....~.. 0020 f9 96 01 f4 01 f4 01 08 b3 12 f2 5a b8 56 0b ba ...........Z.V.. 0030 49 d6 3c 09 4f 0d 96 96 ef dd 04 10 02 00 00 00 I.<.O........... 0040 00 00 00 00 01 00 0a 00 00 84 2f 1e 60 c7 7b 0f ........../.`.{. 0050 ab f0 92 7e 13 be 94 46 a5 6b f8 f1 13 5a e0 80 ...~...F.k...Z.. 0060 f8 7a 09 83 0a 37 61 74 5d d6 30 03 36 80 67 7c .z...7at].0.6.g| 0070 3a 71 b2 12 bb 30 4c 61 87 47 9a 2e 40 47 ea fa :q...0La.G..@G.. 0080 07 2a 5c 7e f2 8a 15 58 d0 9a 27 9a cc 7d 51 72 .*\~...X..'..}Qr 0090 0c e1 ad 49 82 8b a4 69 71 c4 7e ea 67 90 0b 61 ...I...iq.~.g..a 00a0 47 36 4f be 79 42 e4 8e b5 1f ec 64 d5 99 9a ed G6O.yB.....d.... 00b0 01 a4 68 b7 b2 f0 5a f0 b7 3e 86 b7 dd d0 db f9 ..h...Z..>...... 00c0 80 1f 13 7d 69 63 78 6b 6f 9d 0d 00 00 18 70 47 ...}icxko.....pG 00d0 37 01 19 f4 d9 aa 85 4a a3 ec 52 27 a4 1d d3 f8 7......J..R'.... 00e0 e2 eb 0d 00 00 14 12 f5 f2 8c 45 71 68 a9 70 2d ..........Eqh.p- 00f0 9f e2 74 cc 01 00 0d 00 00 0c 09 00 26 89 df d6 ..t.........&... 0100 b7 12 0d 00 00 14 c9 ce e8 10 96 97 ef dd 1f ad ................ 0110 c5 5f a3 f4 b2 8c 00 00 00 14 1f 07 f7 0e aa 65 ._.............e 0120 14 d3 b0 fa 96 54 2a 50 04 07 .....T*P.. Frame 5 (142 bytes on wire, 142 bytes captured) Arrival Time: Aug 10, 2006 13:52:11.835352000 Time delta from previous packet: 0.061819000 seconds Time since reference or first frame: 0.369128000 seconds Frame Number: 5 Packet Length: 142 bytes Capture Length: 142 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa), Dst: 00:05:00:b8:00:e0 (00:05:00:b8:00:e0) Destination: 00:05:00:b8:00:e0 (00:05:00:b8:00:e0) Source: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.150 (165.227.249.150), Dst: 165.227.249.126 (165.227.249.126) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 128 Identification: 0x01a7 (423) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: UDP (0x11) Header checksum: 0xf9e9 [correct] Good: True Bad : False Source: 165.227.249.150 (165.227.249.150) Destination: 165.227.249.126 (165.227.249.126) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 108 Checksum: 0xd640 [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0xF25AB8560BBA49D6 Responder cookie: 0x3C094F0D9696EFDD Next payload: Identification (5) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 100 Encrypted payload (72 bytes) 0000 00 05 00 b8 00 e0 00 0c 29 96 e1 fa 08 00 45 00 ........).....E. 0010 00 80 01 a7 00 00 80 11 f9 e9 a5 e3 f9 96 a5 e3 ................ 0020 f9 7e 01 f4 01 f4 00 6c d6 40 f2 5a b8 56 0b ba .~.....l.@.Z.V.. 0030 49 d6 3c 09 4f 0d 96 96 ef dd 05 10 02 01 00 00 I.<.O........... 0040 00 00 00 00 00 64 55 7d 10 23 b9 62 b9 f5 42 58 .....dU}.#.b..BX 0050 06 b2 d3 58 c4 b7 34 db f3 fc c8 bc 0a 3b 7c 38 ...X..4......;|8 0060 62 61 88 a9 19 37 7f b2 41 61 d9 45 ae 36 75 6f ba...7..Aa.E.6uo 0070 01 ad 48 ec 5f 3b 58 5d cd b1 d0 ea bb 27 f5 c2 ..H._;X].....'.. 0080 93 07 71 60 4c d2 d3 72 74 d0 3e eb ae 4e ..q`L..rt.>..N Frame 6 (126 bytes on wire, 126 bytes captured) Arrival Time: Aug 10, 2006 13:52:12.004424000 Time delta from previous packet: 0.169072000 seconds Time since reference or first frame: 0.538200000 seconds Frame Number: 6 Packet Length: 126 bytes Capture Length: 126 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:05:00:b8:00:e0 (00:05:00:b8:00:e0), Dst: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa) Destination: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa) Source: 00:05:00:b8:00:e0 (00:05:00:b8:00:e0) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.126 (165.227.249.126), Dst: 165.227.249.150 (165.227.249.150) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 112 Identification: 0x9654 (38484) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: UDP (0x11) Header checksum: 0x654c [correct] Good: True Bad : False Source: 165.227.249.126 (165.227.249.126) Destination: 165.227.249.150 (165.227.249.150) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 92 Checksum: 0xe63e [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0xF25AB8560BBA49D6 Responder cookie: 0x3C094F0D9696EFDD Next payload: Identification (5) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 84 Encrypted payload (56 bytes) 0000 00 0c 29 96 e1 fa 00 05 00 b8 00 e0 08 00 45 00 ..)...........E. 0010 00 70 96 54 00 00 80 11 65 4c a5 e3 f9 7e a5 e3 .p.T....eL...~.. 0020 f9 96 01 f4 01 f4 00 5c e6 3e f2 5a b8 56 0b ba .......\.>.Z.V.. 0030 49 d6 3c 09 4f 0d 96 96 ef dd 05 10 02 01 00 00 I.<.O........... 0040 00 00 00 00 00 54 f3 1d af 72 24 99 02 50 60 7d .....T...r$..P`} 0050 9a ec f0 0e 76 a4 e5 e7 a0 54 29 39 da f2 03 cb ....v....T)9.... 0060 74 f1 fd 6b d3 49 34 53 f3 ac a7 10 ab a0 c2 89 t..k.I4S........ 0070 93 29 a7 b2 86 26 2f b5 54 78 30 01 0b 22 .)...&/.Tx0.." Frame 7 (334 bytes on wire, 334 bytes captured) Arrival Time: Aug 10, 2006 13:52:12.045277000 Time delta from previous packet: 0.040853000 seconds Time since reference or first frame: 0.579053000 seconds Frame Number: 7 Packet Length: 334 bytes Capture Length: 334 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa), Dst: 00:05:00:b8:00:e0 (00:05:00:b8:00:e0) Destination: 00:05:00:b8:00:e0 (00:05:00:b8:00:e0) Source: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.150 (165.227.249.150), Dst: 165.227.249.126 (165.227.249.126) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 320 Identification: 0x01a8 (424) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: UDP (0x11) Header checksum: 0xf928 [correct] Good: True Bad : False Source: 165.227.249.150 (165.227.249.150) Destination: 165.227.249.126 (165.227.249.126) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 300 Checksum: 0xea25 [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0xF25AB8560BBA49D6 Responder cookie: 0x3C094F0D9696EFDD Next payload: Hash (8) Version: 1.0 Exchange type: Quick Mode (32) Flags .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0xCE2E0DD3 Length: 292 Encrypted payload (264 bytes) 0000 00 05 00 b8 00 e0 00 0c 29 96 e1 fa 08 00 45 00 ........).....E. 0010 01 40 01 a8 00 00 80 11 f9 28 a5 e3 f9 96 a5 e3 .@.......(...... 0020 f9 7e 01 f4 01 f4 01 2c ea 25 f2 5a b8 56 0b ba .~.....,.%.Z.V.. 0030 49 d6 3c 09 4f 0d 96 96 ef dd 08 10 20 01 ce 2e I.<.O....... ... 0040 0d d3 00 00 01 24 d1 e6 30 46 3e 63 a5 c7 1e 76 .....$..0F>c...v 0050 33 37 cc 8f 9b 23 05 e4 b7 8f 46 fc 00 f2 3f 8c 37...#....F...?. 0060 8f 16 59 aa e9 3f 57 bb 64 a8 cb c3 ed d3 0c e0 ..Y..?W.d....... 0070 bb d4 32 8d 7f 4a 4d 3b b7 ac fe 1f fc 2a 11 c2 ..2..JM;.....*.. 0080 be c8 ea eb ab 25 da 91 dd 79 41 e9 35 de 88 da .....%...yA.5... 0090 be 5a 0b 61 7b 71 b9 fa 5b 35 67 3a 5e bf 8e cb .Z.a{q..[5g:^... 00a0 c8 a6 23 ce 17 5b 13 92 8c c4 9b 3d 3f 68 a1 7f ..#..[.....=?h.. 00b0 72 ad 64 b7 57 18 3f 57 75 24 f7 ce e1 21 51 1d r.d.W.?Wu$...!Q. 00c0 b4 fe 0b ea 73 ce 0a 0c de 83 59 a7 3b b7 09 22 ....s.....Y.;.." 00d0 64 f4 c2 7a 80 00 a1 92 89 b6 96 6e b1 65 77 50 d..z.......n.ewP 00e0 f8 9c 74 15 b8 b1 c7 0f 24 c4 0d 62 93 4e fc 0d ..t.....$..b.N.. 00f0 36 5d fa fe 8f 79 db 2c 8b a5 4f 9b e3 51 ce 40 6]...y.,..O..Q.@ 0100 da 05 77 77 c3 32 6e f5 22 0d 6c 2a 6a 57 b7 9e ..ww.2n.".l*jW.. 0110 d7 46 de c0 ac c4 21 b7 49 fc 70 93 d6 72 20 78 .F....!.I.p..r x 0120 7d c2 29 54 fa 57 06 e5 33 ea 11 35 7b 56 81 b3 }.)T.W..3..5{V.. 0130 10 a8 23 f5 b1 e7 f8 6f d4 91 4b 01 ee 70 37 97 ..#....o..K..p7. 0140 45 18 cd da bd e8 50 7d ab b0 c3 20 ea 09 E.....P}... .. Frame 8 (334 bytes on wire, 334 bytes captured) Arrival Time: Aug 10, 2006 13:52:12.440559000 Time delta from previous packet: 0.395282000 seconds Time since reference or first frame: 0.974335000 seconds Frame Number: 8 Packet Length: 334 bytes Capture Length: 334 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:05:00:b8:00:e0 (00:05:00:b8:00:e0), Dst: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa) Destination: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa) Source: 00:05:00:b8:00:e0 (00:05:00:b8:00:e0) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.126 (165.227.249.126), Dst: 165.227.249.150 (165.227.249.150) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 320 Identification: 0xba1a (47642) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: UDP (0x11) Header checksum: 0x40b6 [correct] Good: True Bad : False Source: 165.227.249.126 (165.227.249.126) Destination: 165.227.249.150 (165.227.249.150) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 300 Checksum: 0xe162 [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0xF25AB8560BBA49D6 Responder cookie: 0x3C094F0D9696EFDD Next payload: Hash (8) Version: 1.0 Exchange type: Quick Mode (32) Flags .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0xCE2E0DD3 Length: 292 Encrypted payload (264 bytes) 0000 00 0c 29 96 e1 fa 00 05 00 b8 00 e0 08 00 45 00 ..)...........E. 0010 01 40 ba 1a 00 00 80 11 40 b6 a5 e3 f9 7e a5 e3 .@......@....~.. 0020 f9 96 01 f4 01 f4 01 2c e1 62 f2 5a b8 56 0b ba .......,.b.Z.V.. 0030 49 d6 3c 09 4f 0d 96 96 ef dd 08 10 20 01 ce 2e I.<.O....... ... 0040 0d d3 00 00 01 24 cf 58 79 f2 7a d9 bb 1f 9d 35 .....$.Xy.z....5 0050 26 48 9e dc 11 5f b7 0a 91 b7 6a c3 cd 90 62 23 &H..._....j...b# 0060 d8 de 58 c5 b3 ee 98 1b 5b 1a ed 1a f9 2e 3d 69 ..X.....[.....=i 0070 25 ad 68 c7 c4 43 19 aa f9 04 af 1f 03 7d 5e 6c %.h..C.......}^l 0080 fb 3b 1b b6 d6 0e dd 3e 88 a2 c0 12 c7 b8 3c 0c .;.....>......<. 0090 fa e7 01 81 6a 24 7b 2a 1a f6 c6 81 d5 3c ec c6 ....j${*.....<.. 00a0 fc af f3 f1 74 5b 38 96 58 ef 12 3a 45 36 bf 43 ....t[8.X..:E6.C 00b0 9b 4f 8c 1e 24 95 d1 f0 81 c9 84 dc 92 ac c8 f6 .O..$........... 00c0 7e aa c6 f9 19 24 ed be 00 c0 82 7c 91 23 9c b9 ~....$.....|.#.. 00d0 de 45 6c bd 1e 22 11 e2 bd e1 d0 bf ee a0 1f 2c .El.."........., 00e0 93 27 f8 19 3c 63 73 36 2a 88 ff 4b 73 c4 31 ed .'..Y]q....x 0050 d7 59 a9 0a 40 de 5b 3a 8b 15 27 4c dd 24 cb e0 .Y..@.[:..'L.$.. 0060 4f 60 a3 60 51 c8 21 db 58 5d d9 22 cf 3c 88 d7 O`.`Q.!.X].".<.. 0070 61 87 8a c4 10 e1 15 0f 6a 7d 78 de 2f 54 0a df a.......j}x./T.. 0080 76 a0 f8 fd 14 81 e6 8c 67 05 54 de 91 1d f9 3e v.......g.T....> 0090 9c 76 3f d2 0f cc 5b 08 bb 6a 79 bc 0b e6 17 67 .v?...[..jy....g 00a0 e6 31 11 34 88 ba b2 6b 26 7f c9 f6 c9 4d fc e0 .1.4...k&....M.. 00b0 e4 9f 15 c6 cf c4 63 3e 22 62 65 6b ce 97 ac a3 ......c>"bek.... 00c0 0a a7 88 c4 03 ee 82 df 59 5a 92 a6 84 39 43 84 ........YZ...9C. 00d0 e4 74 a8 6f 53 c1 b5 8a 7d 35 6e fe c1 37 f7 bc .t.oS...}5n..7.. 00e0 c9 2a ec 64 98 d0 58 2a e8 92 41 bd f0 b6 2a 4f .*.d..X*..A...*O 00f0 8a 8c e2 97 c9 ca 23 1a ee bb dc c0 3a a8 c5 b1 ......#.....:... 0100 05 0a 4d b5 36 ac f8 f0 4b 09 d7 a5 9c 0d 76 ef ..M.6...K.....v. 0110 09 93 e2 5b 3a b7 ff c3 db f8 17 a6 17 61 45 3b ...[:........aE; 0120 67 67 5d d6 aa b0 d5 1d a5 31 56 fe 95 1a 59 f8 gg]......1V...Y. 0130 6c 8c 92 82 b4 db 47 3f 30 15 57 12 e4 b8 be 90 l.....G?0.W..... 0140 2e f8 5f 69 29 14 11 32 26 15 b7 7f 9e ce 13 e3 .._i)..2&....... 0150 7d 56 cd d0 d3 40 16 9f 2f 1e 0a e0 65 72 c4 3b }V...@../...er.; 0160 19 a6 f8 c8 67 7e 62 63 65 c9 8a 6f dd 45 af ab ....g~bce..o.E.. 0170 78 bc c0 c0 81 24 9c 78 d9 48 78 b5 f8 54 b9 55 x....$.x.Hx..T.U 0180 0a 1c 5f 48 2c 1c 44 7e 76 45 10 4d 6e e0 .._H,.D~vE.Mn. Frame 11 (398 bytes on wire, 398 bytes captured) Arrival Time: Aug 10, 2006 13:52:22.176730000 Time delta from previous packet: 0.011559000 seconds Time since reference or first frame: 10.710506000 seconds Frame Number: 11 Packet Length: 398 bytes Capture Length: 398 bytes Protocols in frame: eth:ip:esp:data Ethernet II, Src: 00:05:00:b8:00:e0 (00:05:00:b8:00:e0), Dst: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa) Destination: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa) Source: 00:05:00:b8:00:e0 (00:05:00:b8:00:e0) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.126 (165.227.249.126), Dst: 165.227.249.150 (165.227.249.150) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 384 Identification: 0x0001 (1) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: ESP (0x32) Header checksum: 0x3a6f [correct] Good: True Bad : False Source: 165.227.249.126 (165.227.249.126) Destination: 165.227.249.150 (165.227.249.150) Encapsulating Security Payload SPI: 0xf9827a48 Sequence: 1 Data (356 bytes) 0000 00 0c 29 96 e1 fa 00 05 00 b8 00 e0 08 00 45 00 ..)...........E. 0010 01 80 00 01 00 00 40 32 3a 6f a5 e3 f9 7e a5 e3 ......@2:o...~.. 0020 f9 96 f9 82 7a 48 00 00 00 01 93 89 9f 90 53 b0 ....zH........S. 0030 1d 63 40 99 3a fd e9 0b 6f 8a 60 9c 90 25 db fd .c@.:...o.`..%.. 0040 75 48 d6 11 9b 80 cd 63 b3 56 83 93 a9 f6 b9 0c uH.....c.V...... 0050 5f 8d e1 f3 7e aa c3 9e b6 c4 02 32 ff 10 97 df _...~......2.... 0060 24 48 30 15 44 4e a7 fa 72 0e 24 8d 42 6f 10 eb $H0.DN..r.$.Bo.. 0070 fb e5 e4 6f 0f 34 51 85 36 aa 6f 17 cb 0f f0 e7 ...o.4Q.6.o..... 0080 9c cd 7a 87 a9 d7 32 d5 87 8d 3c ed 53 d4 d0 d1 ..z...2...<.S... 0090 2c fc aa ba 96 41 91 16 fb 26 c3 ee 92 4f c5 ae ,....A...&...O.. 00a0 49 5f e2 fd 9e 99 2f 59 e4 85 00 b3 d4 41 3f 1d I_..../Y.....A?. 00b0 29 da 99 a7 66 89 79 dc ec 93 8e 3b 5a a1 4f f3 )...f.y....;Z.O. 00c0 02 76 43 37 76 50 4f 58 86 40 91 3b b0 fe 2f 2d .vC7vPOX.@.;../- 00d0 9c fd 4b 71 a4 b6 b6 f4 9e 51 b0 ba 95 83 71 fa ..Kq.....Q....q. 00e0 23 33 54 86 42 99 aa 15 ae 34 f8 ea 58 ca a7 38 #3T.B....4..X..8 00f0 8d 7c 33 2e e0 ec c9 49 8b 69 09 2d fb 82 1e 86 .|3....I.i.-.... 0100 dc d1 8f 81 b6 f0 e4 c9 64 cb 72 d6 4e 62 8a 48 ........d.r.Nb.H 0110 5c 69 e1 2f 74 17 22 52 5c b2 99 ab f2 1f e5 6b \i./t."R\......k 0120 6e 5a c2 93 6f 1b f9 79 6c f9 2c 83 9d e6 1d 38 nZ..o..yl.,....8 0130 d0 2f 2c 88 ab 8d 04 86 da 37 91 f2 9f 44 7c 78 ./,......7...D|x 0140 b8 04 db 71 e3 c9 a9 de 24 e7 38 c5 60 20 2f 3d ...q....$.8.` /= 0150 3a fa 10 4b 60 8a 9d 17 7f 4a 20 0a 9d 9a 68 5e :..K`....J ...h^ 0160 43 23 88 85 8f 77 25 e9 7f 0e 04 72 9c 1a 35 f7 C#...w%....r..5. 0170 39 6b a2 b8 af 65 ab 33 00 b9 23 f7 6a 69 19 47 9k...e.3..#.ji.G 0180 77 08 ad 55 2e e9 52 5f c6 2c 36 7d c8 16 w..U..R_.,6}..