Frame 1 (222 bytes on wire, 222 bytes captured) Arrival Time: Aug 10, 2006 14:26:48.151769000 Time delta from previous packet: 0.000000000 seconds Time since reference or first frame: 0.000000000 seconds Frame Number: 1 Packet Length: 222 bytes Capture Length: 222 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa), Dst: 00:80:c8:ca:a8:82 (00:80:c8:ca:a8:82) Destination: 00:80:c8:ca:a8:82 (00:80:c8:ca:a8:82) Source: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.150 (165.227.249.150), Dst: 165.227.249.130 (165.227.249.130) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 208 Identification: 0x0225 (549) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: UDP (0x11) Header checksum: 0xf917 [correct] Good: True Bad : False Source: 165.227.249.150 (165.227.249.150) Destination: 165.227.249.130 (165.227.249.130) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 188 Checksum: 0x6718 [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0x6D023786B3991751 Responder cookie: 0x0000000000000000 Next payload: Security Association (1) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 180 Security Association payload Next payload: Vendor ID (13) Length: 52 Domain of interpretation: IPSEC (1) Situation: IDENTITY (1) Proposal payload # 1 Next payload: NONE (0) Length: 40 Proposal number: 1 Protocol ID: ISAKMP (1) SPI size: 0 Number of transforms: 1 Transform payload # 1 Next payload: NONE (0) Length: 32 Transform number: 1 Transform ID: KEY_IKE (1) Encryption-Algorithm (1): 3DES-CBC (5) Hash-Algorithm (2): SHA (2) Group-Description (4): Alternate 1024-bit MODP group (2) Authentication-Method (3): PSK (1) Life-Type (11): Seconds (1) Life-Duration (12): Duration-Value (28800) Vendor ID payload Next payload: Vendor ID (13) Length: 20 Vendor ID: unknown vendor ID: 0x4A131C81070358455C5728F20E95452F Vendor ID payload Next payload: Vendor ID (13) Length: 20 Vendor ID: draft-ietf-ipsec-nat-t-ike-03 Vendor ID payload Next payload: Vendor ID (13) Length: 20 Vendor ID: draft-ietf-ipsec-nat-t-ike-02 Vendor ID payload Next payload: Vendor ID (13) Length: 20 Vendor ID: draft-ietf-ipsec-nat-t-ike-00 Vendor ID payload Next payload: NONE (0) Length: 20 Vendor ID: RFC 3706 Detecting Dead IKE Peers (DPD) 0000 00 80 c8 ca a8 82 00 0c 29 96 e1 fa 08 00 45 00 ........).....E. 0010 00 d0 02 25 00 00 80 11 f9 17 a5 e3 f9 96 a5 e3 ...%............ 0020 f9 82 01 f4 01 f4 00 bc 67 18 6d 02 37 86 b3 99 ........g.m.7... 0030 17 51 00 00 00 00 00 00 00 00 01 10 02 00 00 00 .Q.............. 0040 00 00 00 00 00 b4 0d 00 00 34 00 00 00 01 00 00 .........4...... 0050 00 01 00 00 00 28 01 01 00 01 00 00 00 20 01 01 .....(....... .. 0060 00 00 80 01 00 05 80 02 00 02 80 04 00 02 80 03 ................ 0070 00 01 80 0b 00 01 80 0c 70 80 0d 00 00 14 4a 13 ........p.....J. 0080 1c 81 07 03 58 45 5c 57 28 f2 0e 95 45 2f 0d 00 ....XE\W(...E/.. 0090 00 14 7d 94 19 a6 53 10 ca 6f 2c 17 9d 92 15 52 ..}...S..o,....R 00a0 9d 56 0d 00 00 14 90 cb 80 91 3e bb 69 6e 08 63 .V........>.in.c 00b0 81 b5 ec 42 7b 1f 0d 00 00 14 44 85 15 2d 18 b6 ...B{.....D..-.. 00c0 bb cd 0b e8 a8 46 95 79 dd cc 00 00 00 14 af ca .....F.y........ 00d0 d7 13 68 a1 f1 c9 6b 86 96 fc 77 57 01 00 ..h...k...wW.. Frame 2 (182 bytes on wire, 182 bytes captured) Arrival Time: Aug 10, 2006 14:26:48.155559000 Time delta from previous packet: 0.003790000 seconds Time since reference or first frame: 0.003790000 seconds Frame Number: 2 Packet Length: 182 bytes Capture Length: 182 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:80:c8:ca:a8:82 (00:80:c8:ca:a8:82), Dst: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa) Destination: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa) Source: 00:80:c8:ca:a8:82 (00:80:c8:ca:a8:82) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.130 (165.227.249.130), Dst: 165.227.249.150 (165.227.249.150) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 168 Identification: 0x0000 (0) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfb64 [correct] Good: True Bad : False Source: 165.227.249.130 (165.227.249.130) Destination: 165.227.249.150 (165.227.249.150) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 148 Checksum: 0xbcee [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0x6D023786B3991751 Responder cookie: 0xCD2C71145CCC7FA1 Next payload: Security Association (1) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 140 Security Association payload Next payload: Vendor ID (13) Length: 52 Domain of interpretation: IPSEC (1) Situation: IDENTITY (1) Proposal payload # 1 Next payload: NONE (0) Length: 40 Proposal number: 1 Protocol ID: ISAKMP (1) SPI size: 0 Number of transforms: 1 Transform payload # 1 Next payload: NONE (0) Length: 32 Transform number: 1 Transform ID: KEY_IKE (1) Encryption-Algorithm (1): 3DES-CBC (5) Hash-Algorithm (2): SHA (2) Group-Description (4): Alternate 1024-bit MODP group (2) Authentication-Method (3): PSK (1) Life-Type (11): Seconds (1) Life-Duration (12): Duration-Value (28800) Vendor ID payload Next payload: Vendor ID (13) Length: 20 Vendor ID: unknown vendor ID: 0xBAEB239037E17787D730EED9D95D48AA Vendor ID payload Next payload: Vendor ID (13) Length: 20 Vendor ID: unknown vendor ID: 0xC573B056D7FACA36C2FBA28374127CBF Vendor ID payload Next payload: NONE (0) Length: 20 Vendor ID: unknown vendor ID: 0x431CFC9292A0595D7592FEBEA586AD19 0000 00 0c 29 96 e1 fa 00 80 c8 ca a8 82 08 00 45 00 ..)...........E. 0010 00 a8 00 00 40 00 40 11 fb 64 a5 e3 f9 82 a5 e3 ....@.@..d...... 0020 f9 96 01 f4 01 f4 00 94 bc ee 6d 02 37 86 b3 99 ..........m.7... 0030 17 51 cd 2c 71 14 5c cc 7f a1 01 10 02 00 00 00 .Q.,q.\......... 0040 00 00 00 00 00 8c 0d 00 00 34 00 00 00 01 00 00 .........4...... 0050 00 01 00 00 00 28 01 01 00 01 00 00 00 20 01 01 .....(....... .. 0060 00 00 80 01 00 05 80 02 00 02 80 04 00 02 80 03 ................ 0070 00 01 80 0b 00 01 80 0c 70 80 0d 00 00 14 ba eb ........p....... 0080 23 90 37 e1 77 87 d7 30 ee d9 d9 5d 48 aa 0d 00 #.7.w..0...]H... 0090 00 14 c5 73 b0 56 d7 fa ca 36 c2 fb a2 83 74 12 ...s.V...6....t. 00a0 7c bf 00 00 00 14 43 1c fc 92 92 a0 59 5d 75 92 |.....C.....Y]u. 00b0 fe be a5 86 ad 19 ...... Frame 3 (222 bytes on wire, 222 bytes captured) Arrival Time: Aug 10, 2006 14:26:48.186220000 Time delta from previous packet: 0.030661000 seconds Time since reference or first frame: 0.034451000 seconds Frame Number: 3 Packet Length: 222 bytes Capture Length: 222 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa), Dst: 00:80:c8:ca:a8:82 (00:80:c8:ca:a8:82) Destination: 00:80:c8:ca:a8:82 (00:80:c8:ca:a8:82) Source: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.150 (165.227.249.150), Dst: 165.227.249.130 (165.227.249.130) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 208 Identification: 0x0226 (550) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: UDP (0x11) Header checksum: 0xf916 [correct] Good: True Bad : False Source: 165.227.249.150 (165.227.249.150) Destination: 165.227.249.130 (165.227.249.130) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 188 Checksum: 0x8ddd [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0x6D023786B3991751 Responder cookie: 0xCD2C71145CCC7FA1 Next payload: Key Exchange (4) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 180 Key Exchange payload Next payload: Nonce (10) Length: 132 Key Exchange Data Nonce payload Next payload: NONE (0) Length: 20 Nonce Data 0000 00 80 c8 ca a8 82 00 0c 29 96 e1 fa 08 00 45 00 ........).....E. 0010 00 d0 02 26 00 00 80 11 f9 16 a5 e3 f9 96 a5 e3 ...&............ 0020 f9 82 01 f4 01 f4 00 bc 8d dd 6d 02 37 86 b3 99 ..........m.7... 0030 17 51 cd 2c 71 14 5c cc 7f a1 04 10 02 00 00 00 .Q.,q.\......... 0040 00 00 00 00 00 b4 0a 00 00 84 66 ac 00 65 78 99 ..........f..ex. 0050 1a 25 50 a2 bf 3f 5e b3 b4 6c f6 e4 c7 c6 5f 00 .%P..?^..l...._. 0060 2a bb d9 ba b5 ec c6 6e a3 23 cf be 63 12 8b 4e *......n.#..c..N 0070 12 d2 85 e6 3b fc 86 92 8e f9 b1 f4 01 7c 35 e3 ....;........|5. 0080 ad 31 b3 90 7e c4 5a 11 fe 2c 71 f4 42 77 5a 5d .1..~.Z..,q.BwZ] 0090 02 04 51 97 62 ea 44 58 c1 a7 73 2e 15 9e 46 e2 ..Q.b.DX..s...F. 00a0 d5 9c 99 8c 27 bb 9c 09 02 14 d6 90 46 cf d2 b8 ....'.......F... 00b0 59 bb 75 05 ac 12 a9 c0 50 5f 5f 5e 0f 62 34 86 Y.u.....P__^.b4. 00c0 16 8b a4 6f b0 1b ed 0d b7 b5 00 00 00 14 6b 56 ...o..........kV 00d0 e4 29 8a 60 b5 c6 ca 90 6e 5d da 3a df 66 .).`....n].:.f Frame 4 (222 bytes on wire, 222 bytes captured) Arrival Time: Aug 10, 2006 14:26:48.195114000 Time delta from previous packet: 0.008894000 seconds Time since reference or first frame: 0.043345000 seconds Frame Number: 4 Packet Length: 222 bytes Capture Length: 222 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:80:c8:ca:a8:82 (00:80:c8:ca:a8:82), Dst: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa) Destination: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa) Source: 00:80:c8:ca:a8:82 (00:80:c8:ca:a8:82) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.130 (165.227.249.130), Dst: 165.227.249.150 (165.227.249.150) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 208 Identification: 0x0000 (0) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfb3c [correct] Good: True Bad : False Source: 165.227.249.130 (165.227.249.130) Destination: 165.227.249.150 (165.227.249.150) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 188 Checksum: 0x82d2 [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0x6D023786B3991751 Responder cookie: 0xCD2C71145CCC7FA1 Next payload: Key Exchange (4) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 180 Key Exchange payload Next payload: Nonce (10) Length: 132 Key Exchange Data Nonce payload Next payload: NONE (0) Length: 20 Nonce Data 0000 00 0c 29 96 e1 fa 00 80 c8 ca a8 82 08 00 45 00 ..)...........E. 0010 00 d0 00 00 40 00 40 11 fb 3c a5 e3 f9 82 a5 e3 ....@.@..<...... 0020 f9 96 01 f4 01 f4 00 bc 82 d2 6d 02 37 86 b3 99 ..........m.7... 0030 17 51 cd 2c 71 14 5c cc 7f a1 04 10 02 00 00 00 .Q.,q.\......... 0040 00 00 00 00 00 b4 0a 00 00 84 01 06 b8 ac d0 3f ...............? 0050 4a 2d 82 40 9e 1e c0 a1 3b 6c fa df 48 99 f7 4e J-.@....;l..H..N 0060 2e 97 9b 12 67 cf 46 0d 98 35 d3 ea 44 91 0a 0c ....g.F..5..D... 0070 d2 ff 74 21 31 57 12 53 7e 2e 83 0e ca 3d ca da ..t!1W.S~....=.. 0080 c3 1d 59 09 08 82 91 a4 f2 d5 4f 80 9e 97 ff b6 ..Y.......O..... 0090 76 67 5c 09 da f4 68 a3 dc a8 93 c8 5e d5 50 51 vg\...h.....^.PQ 00a0 28 89 5d 52 c0 5d de c4 fe 40 92 8b 83 cb d2 9c (.]R.]...@...... 00b0 20 ac 30 c2 82 65 ac 95 45 45 ff e9 e7 54 2f d8 .0..e..EE...T/. 00c0 41 17 b1 f5 a8 ad 6a 10 29 e8 00 00 00 14 9f 05 A.....j.)....... 00d0 cf 13 f1 85 1c 23 b2 0c e6 7e fd b0 27 63 .....#...~..'c Frame 5 (142 bytes on wire, 142 bytes captured) Arrival Time: Aug 10, 2006 14:26:48.221825000 Time delta from previous packet: 0.026711000 seconds Time since reference or first frame: 0.070056000 seconds Frame Number: 5 Packet Length: 142 bytes Capture Length: 142 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa), Dst: 00:80:c8:ca:a8:82 (00:80:c8:ca:a8:82) Destination: 00:80:c8:ca:a8:82 (00:80:c8:ca:a8:82) Source: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.150 (165.227.249.150), Dst: 165.227.249.130 (165.227.249.130) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 128 Identification: 0x0227 (551) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: UDP (0x11) Header checksum: 0xf965 [correct] Good: True Bad : False Source: 165.227.249.150 (165.227.249.150) Destination: 165.227.249.130 (165.227.249.130) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 108 Checksum: 0x6c91 [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0x6D023786B3991751 Responder cookie: 0xCD2C71145CCC7FA1 Next payload: Identification (5) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 100 Encrypted payload (72 bytes) 0000 00 80 c8 ca a8 82 00 0c 29 96 e1 fa 08 00 45 00 ........).....E. 0010 00 80 02 27 00 00 80 11 f9 65 a5 e3 f9 96 a5 e3 ...'.....e...... 0020 f9 82 01 f4 01 f4 00 6c 6c 91 6d 02 37 86 b3 99 .......ll.m.7... 0030 17 51 cd 2c 71 14 5c cc 7f a1 05 10 02 01 00 00 .Q.,q.\......... 0040 00 00 00 00 00 64 ba 22 6a a8 e5 96 d5 66 c7 71 .....d."j....f.q 0050 9c 01 03 99 91 02 c9 31 ae 9f f5 a4 43 1b f5 fc .......1....C... 0060 53 94 75 80 5c f3 04 6b d0 08 29 e5 9e af dc 6f S.u.\..k..)....o 0070 11 68 7a 1f e4 16 97 5a f4 32 53 79 a5 81 44 2b .hz....Z.2Sy..D+ 0080 bf 3a f3 c2 2f 21 45 9b 28 e2 e1 3e 36 10 .:../!E.(..>6. Frame 6 (110 bytes on wire, 110 bytes captured) Arrival Time: Aug 10, 2006 14:26:48.225701000 Time delta from previous packet: 0.003876000 seconds Time since reference or first frame: 0.073932000 seconds Frame Number: 6 Packet Length: 110 bytes Capture Length: 110 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:80:c8:ca:a8:82 (00:80:c8:ca:a8:82), Dst: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa) Destination: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa) Source: 00:80:c8:ca:a8:82 (00:80:c8:ca:a8:82) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.130 (165.227.249.130), Dst: 165.227.249.150 (165.227.249.150) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 96 Identification: 0x0000 (0) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfbac [correct] Good: True Bad : False Source: 165.227.249.130 (165.227.249.130) Destination: 165.227.249.150 (165.227.249.150) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 76 Checksum: 0xd031 [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0x6D023786B3991751 Responder cookie: 0xCD2C71145CCC7FA1 Next payload: Identification (5) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 68 Encrypted payload (40 bytes) 0000 00 0c 29 96 e1 fa 00 80 c8 ca a8 82 08 00 45 00 ..)...........E. 0010 00 60 00 00 40 00 40 11 fb ac a5 e3 f9 82 a5 e3 .`..@.@......... 0020 f9 96 01 f4 01 f4 00 4c d0 31 6d 02 37 86 b3 99 .......L.1m.7... 0030 17 51 cd 2c 71 14 5c cc 7f a1 05 10 02 01 00 00 .Q.,q.\......... 0040 00 00 00 00 00 44 62 0a 2b c9 af 38 9e 23 56 eb .....Db.+..8.#V. 0050 ca fc c9 2c 3f 02 28 69 ae e4 6e fd 0a 9c 0c 19 ...,?.(i..n..... 0060 34 07 70 83 61 5d 6e 9b 6c 4b 6c 7f ab 4e 4.p.a]n.lKl..N Frame 7 (334 bytes on wire, 334 bytes captured) Arrival Time: Aug 10, 2006 14:26:48.265283000 Time delta from previous packet: 0.039582000 seconds Time since reference or first frame: 0.113514000 seconds Frame Number: 7 Packet Length: 334 bytes Capture Length: 334 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa), Dst: 00:80:c8:ca:a8:82 (00:80:c8:ca:a8:82) Destination: 00:80:c8:ca:a8:82 (00:80:c8:ca:a8:82) Source: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.150 (165.227.249.150), Dst: 165.227.249.130 (165.227.249.130) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 320 Identification: 0x0228 (552) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: UDP (0x11) Header checksum: 0xf8a4 [correct] Good: True Bad : False Source: 165.227.249.150 (165.227.249.150) Destination: 165.227.249.130 (165.227.249.130) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 300 Checksum: 0x86e3 [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0x6D023786B3991751 Responder cookie: 0xCD2C71145CCC7FA1 Next payload: Hash (8) Version: 1.0 Exchange type: Quick Mode (32) Flags .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x0747AFE4 Length: 292 Encrypted payload (264 bytes) 0000 00 80 c8 ca a8 82 00 0c 29 96 e1 fa 08 00 45 00 ........).....E. 0010 01 40 02 28 00 00 80 11 f8 a4 a5 e3 f9 96 a5 e3 .@.(............ 0020 f9 82 01 f4 01 f4 01 2c 86 e3 6d 02 37 86 b3 99 .......,..m.7... 0030 17 51 cd 2c 71 14 5c cc 7f a1 08 10 20 01 07 47 .Q.,q.\..... ..G 0040 af e4 00 00 01 24 ce 09 25 47 78 c0 da 1c 1f fa .....$..%Gx..... 0050 7e ab d6 31 85 90 51 9d 73 5f 10 f0 1d 23 76 48 ~..1..Q.s_...#vH 0060 67 fd 98 6a c8 70 0d c8 b9 ce cf 7f 8e 49 78 af g..j.p.......Ix. 0070 59 db 81 79 cb 2f 49 94 fe 42 0c 57 5a 88 fd 9e Y..y./I..B.WZ... 0080 5e ad a5 ef 86 f5 ef b6 8e e4 be 1a c5 37 da f8 ^............7.. 0090 73 cc 8f fa 58 59 b1 b0 f2 5d ba c2 98 4d e0 0e s...XY...]...M.. 00a0 98 e4 7a 05 3f 21 8d cb ee fa d4 18 21 74 96 45 ..z.?!......!t.E 00b0 6d e5 66 4e 69 33 74 33 0f b5 2f b5 15 a5 09 66 m.fNi3t3../....f 00c0 84 7d 6c c1 fd 84 dc 47 12 23 ed f3 34 44 d6 0a .}l....G.#..4D.. 00d0 91 7a 62 f0 cd 40 77 3d 18 41 86 03 fa 3b f5 c1 .zb..@w=.A...;.. 00e0 93 81 03 61 79 85 86 0e 6c 53 b6 5d 64 97 36 42 ...ay...lS.]d.6B 00f0 45 35 45 2e 1b b7 08 04 9a 21 df b8 cc 56 72 e8 E5E......!...Vr. 0100 7c 98 53 d9 60 7b 21 51 ec 84 3c 3f 9f c3 db 2f |.S.`{!Q.... 00b0 e9 72 56 d8 a3 b0 8d 71 4f bf 31 5e 12 b8 1b 53 .rV....qO.1^...S 00c0 fa f7 28 fb 4d 09 17 80 74 45 a9 01 5a 67 30 7a ..(.M...tE..Zg0z 00d0 6d ab f2 60 2f df 43 f6 2a 37 39 38 c5 da 73 49 m..`/.C.*798..sI 00e0 cc 7d 35 c3 4c 5d 96 6b cf 99 c0 6b 5b 65 34 62 .}5.L].k...k[e4b 00f0 2b 49 d0 c9 35 32 5b d0 66 86 4c fd c0 cd f0 b8 +I..52[.f.L..... 0100 e3 bf b9 06 f6 2e 78 d5 4d 61 fe a7 36 db d6 2b ......x.Ma..6..+ 0110 49 cd cb 76 06 46 f9 8e d7 b9 8e b3 db 1a 7d 7f I..v.F........}. 0120 25 c6 ca 4d 6a 2c 19 da 29 05 ed b2 a3 a1 b4 31 %..Mj,..)......1 0130 7f c7 4b 48 fc 99 38 15 cf b0 94 26 9b f4 56 9e ..KH..8....&..V. 0140 53 09 e8 7b f5 11 S..{.. Frame 9 (326 bytes on wire, 326 bytes captured) Arrival Time: Aug 10, 2006 14:26:48.396674000 Time delta from previous packet: 0.113618000 seconds Time since reference or first frame: 0.244905000 seconds Frame Number: 9 Packet Length: 326 bytes Capture Length: 326 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:80:c8:ca:a8:82 (00:80:c8:ca:a8:82), Dst: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa) Destination: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa) Source: 00:80:c8:ca:a8:82 (00:80:c8:ca:a8:82) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.130 (165.227.249.130), Dst: 165.227.249.150 (165.227.249.150) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 312 Identification: 0x0000 (0) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfad4 [correct] Good: True Bad : False Source: 165.227.249.130 (165.227.249.130) Destination: 165.227.249.150 (165.227.249.150) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 292 Checksum: 0x66c7 [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0x6D023786B3991751 Responder cookie: 0xCD2C71145CCC7FA1 Next payload: Hash (8) Version: 1.0 Exchange type: Quick Mode (32) Flags .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x0747AFE4 Length: 284 Encrypted payload (256 bytes) 0000 00 0c 29 96 e1 fa 00 80 c8 ca a8 82 08 00 45 00 ..)...........E. 0010 01 38 00 00 40 00 40 11 fa d4 a5 e3 f9 82 a5 e3 .8..@.@......... 0020 f9 96 01 f4 01 f4 01 24 66 c7 6d 02 37 86 b3 99 .......$f.m.7... 0030 17 51 cd 2c 71 14 5c cc 7f a1 08 10 20 01 07 47 .Q.,q.\..... ..G 0040 af e4 00 00 01 1c 1a 98 21 19 19 8d e8 95 e9 b8 ........!....... 0050 29 86 20 35 c6 e2 a5 17 ee ed c2 e4 bb ca 87 6e ). 5...........n 0060 f3 cb ce e8 81 0e 9d 85 24 72 b8 f2 8e 2e e6 38 ........$r.....8 0070 a7 d8 e3 ad ce a5 b5 91 c8 ba 2a 92 07 c6 5c e5 ..........*...\. 0080 0c 1e 08 62 9c fa ae db 1a 50 1c db f2 56 e4 09 ...b.....P...V.. 0090 4f 4c 28 66 2e b3 85 91 79 99 3a 79 f8 49 0f ed OL(f....y.:y.I.. 00a0 bd 56 11 90 0d f3 34 d1 b4 7c 69 1f a7 3e f4 cc .V....4..|i..>.. 00b0 e9 72 56 d8 a3 b0 8d 71 4f bf 31 5e 12 b8 1b 53 .rV....qO.1^...S 00c0 fa f7 28 fb 4d 09 17 80 74 45 a9 01 5a 67 30 7a ..(.M...tE..Zg0z 00d0 6d ab f2 60 2f df 43 f6 2a 37 39 38 c5 da 73 49 m..`/.C.*798..sI 00e0 cc 7d 35 c3 4c 5d 96 6b cf 99 c0 6b 5b 65 34 62 .}5.L].k...k[e4b 00f0 2b 49 d0 c9 35 32 5b d0 66 86 4c fd c0 cd f0 b8 +I..52[.f.L..... 0100 e3 bf b9 06 f6 2e 78 d5 4d 61 fe a7 36 db d6 2b ......x.Ma..6..+ 0110 49 cd cb 76 06 46 f9 8e d7 b9 8e b3 db 1a 7d 7f I..v.F........}. 0120 25 c6 ca 4d 6a 2c 19 da 29 05 ed b2 a3 a1 b4 31 %..Mj,..)......1 0130 7f c7 4b 48 fc 99 38 15 cf b0 94 26 9b f4 56 9e ..KH..8....&..V. 0140 53 09 e8 7b f5 11 S..{.. Frame 10 (102 bytes on wire, 102 bytes captured) Arrival Time: Aug 10, 2006 14:26:48.396676000 Time delta from previous packet: 0.000002000 seconds Time since reference or first frame: 0.244907000 seconds Frame Number: 10 Packet Length: 102 bytes Capture Length: 102 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa), Dst: 00:80:c8:ca:a8:82 (00:80:c8:ca:a8:82) Destination: 00:80:c8:ca:a8:82 (00:80:c8:ca:a8:82) Source: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.150 (165.227.249.150), Dst: 165.227.249.130 (165.227.249.130) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 88 Identification: 0x0229 (553) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: UDP (0x11) Header checksum: 0xf98b [correct] Good: True Bad : False Source: 165.227.249.150 (165.227.249.150) Destination: 165.227.249.130 (165.227.249.130) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 68 Checksum: 0xe632 [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0x6D023786B3991751 Responder cookie: 0xCD2C71145CCC7FA1 Next payload: Hash (8) Version: 1.0 Exchange type: Quick Mode (32) Flags .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x0747AFE4 Length: 60 Encrypted payload (32 bytes) 0000 00 80 c8 ca a8 82 00 0c 29 96 e1 fa 08 00 45 00 ........).....E. 0010 00 58 02 29 00 00 80 11 f9 8b a5 e3 f9 96 a5 e3 .X.)............ 0020 f9 82 01 f4 01 f4 00 44 e6 32 6d 02 37 86 b3 99 .......D.2m.7... 0030 17 51 cd 2c 71 14 5c cc 7f a1 08 10 20 01 07 47 .Q.,q.\..... ..G 0040 af e4 00 00 00 3c 1c f5 ff 28 ca 74 bc c2 80 bf .....<...(.t.... 0050 69 0b e4 25 31 36 93 5c 0c 29 8f 66 e3 f7 b6 14 i..%16.\.).f.... 0060 cd 26 a7 6c 8c c6 .&.l.. Frame 11 (398 bytes on wire, 398 bytes captured) Arrival Time: Aug 10, 2006 14:27:05.042109000 Time delta from previous packet: 16.645433000 seconds Time since reference or first frame: 16.890340000 seconds Frame Number: 11 Packet Length: 398 bytes Capture Length: 398 bytes Protocols in frame: eth:ip:esp:data Ethernet II, Src: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa), Dst: 00:80:c8:ca:a8:82 (00:80:c8:ca:a8:82) Destination: 00:80:c8:ca:a8:82 (00:80:c8:ca:a8:82) Source: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.150 (165.227.249.150), Dst: 165.227.249.130 (165.227.249.130) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 384 Identification: 0x022a (554) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: ESP (0x32) Header checksum: 0xf841 [correct] Good: True Bad : False Source: 165.227.249.150 (165.227.249.150) Destination: 165.227.249.130 (165.227.249.130) Encapsulating Security Payload SPI: 0xf17fbe4c Sequence: 1 Data (356 bytes) 0000 00 80 c8 ca a8 82 00 0c 29 96 e1 fa 08 00 45 00 ........).....E. 0010 01 80 02 2a 00 00 80 32 f8 41 a5 e3 f9 96 a5 e3 ...*...2.A...... 0020 f9 82 f1 7f be 4c 00 00 00 01 4f f0 12 90 3a 4e .....L....O...:N 0030 ae 2c 45 cd 89 a0 61 e5 3f 59 4d 85 4b 81 c2 64 .,E...a.?YM.K..d 0040 a1 65 37 d9 e0 af b6 26 75 3d 2d 30 02 d0 83 47 .e7....&u=-0...G 0050 18 a8 d3 f5 08 6c 53 c3 1f b5 3d ee 35 f5 f8 1d .....lS...=.5... 0060 1f b6 ca eb a2 29 dc f5 f2 d0 af 59 dd 97 2e 80 .....).....Y.... 0070 bf 2c 4c c9 ed e7 48 c8 db 23 99 4b c3 58 ce 1a .,L...H..#.K.X.. 0080 6e 4c de d3 af d4 15 08 e6 c4 d0 dc 27 69 96 03 nL..........'i.. 0090 60 b0 d2 7a c3 2b bb 7d 52 c3 aa e0 ec 22 9d 12 `..z.+.}R....".. 00a0 0f 00 ac 1d 77 64 6e 43 bd 64 37 85 29 1a 90 d5 ....wdnC.d7.)... 00b0 0a f5 99 64 82 9e 8d 11 79 b5 2c e8 9a 1c 49 a2 ...d....y.,...I. 00c0 6c f2 0c f6 69 91 5a 1e 4c 83 ba 68 fd 22 69 c5 l...i.Z.L..h."i. 00d0 90 23 f5 e2 c9 84 e7 94 b4 b8 ad 56 69 da 8f da .#.........Vi... 00e0 b5 f7 00 5d 5f 2a 4f ed 08 eb b9 79 ab 16 e8 90 ...]_*O....y.... 00f0 a5 22 04 56 0b 5b 8c 0d 20 45 96 23 be a4 33 68 .".V.[.. E.#..3h 0100 b2 0e 68 52 57 90 4e a3 48 8b 5c be 9d f0 46 a3 ..hRW.N.H.\...F. 0110 7e 30 2b 75 c2 22 94 d9 32 86 75 39 57 13 5a b6 ~0+u."..2.u9W.Z. 0120 25 79 7a bc a3 89 e2 be c3 22 8c 8f a2 c2 d6 20 %yz......"..... 0130 6e 99 ef be a6 e1 77 d4 8d 36 38 ed 59 42 12 c3 n.....w..68.YB.. 0140 f8 d5 dc d5 41 9a 5b b1 57 f7 8f f4 45 30 99 12 ....A.[.W...E0.. 0150 09 65 aa dd 16 e8 96 d3 bb 69 66 58 5f 55 80 c9 .e.......ifX_U.. 0160 8a e2 79 32 45 42 7a a7 ad b7 f8 ef e1 c5 f0 50 ..y2EBz........P 0170 92 83 8e 80 60 39 b9 c7 2d 18 35 97 65 15 e4 48 ....`9..-.5.e..H 0180 27 0a cc ba ab b0 da bc 25 a8 75 26 19 66 '.......%.u&.f Frame 12 (398 bytes on wire, 398 bytes captured) Arrival Time: Aug 10, 2006 14:27:05.055014000 Time delta from previous packet: 0.012905000 seconds Time since reference or first frame: 16.903245000 seconds Frame Number: 12 Packet Length: 398 bytes Capture Length: 398 bytes Protocols in frame: eth:ip:esp:data Ethernet II, Src: 00:80:c8:ca:a8:82 (00:80:c8:ca:a8:82), Dst: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa) Destination: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa) Source: 00:80:c8:ca:a8:82 (00:80:c8:ca:a8:82) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.130 (165.227.249.130), Dst: 165.227.249.150 (165.227.249.150) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 384 Identification: 0x0000 (0) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 240 Protocol: ESP (0x32) Header checksum: 0x8a6b [correct] Good: True Bad : False Source: 165.227.249.130 (165.227.249.130) Destination: 165.227.249.150 (165.227.249.150) Encapsulating Security Payload SPI: 0x78f6b751 Sequence: 1 Data (356 bytes) 0000 00 0c 29 96 e1 fa 00 80 c8 ca a8 82 08 00 45 00 ..)...........E. 0010 01 80 00 00 00 00 f0 32 8a 6b a5 e3 f9 82 a5 e3 .......2.k...... 0020 f9 96 78 f6 b7 51 00 00 00 01 d5 c2 a2 18 df 0a ..x..Q.......... 0030 a1 65 3f 8e f3 32 51 f4 c1 e4 b8 48 b7 0a 5e ad .e?..2Q....H..^. 0040 02 20 78 1e f8 9c 58 a9 50 1b 16 29 4b a7 71 c3 . x...X.P..)K.q. 0050 d4 88 11 81 f7 9a b7 1a b5 7d f2 3a 2c 08 46 8d .........}.:,.F. 0060 07 f1 6e f0 9d cb b6 fa 4c 55 39 79 95 30 03 88 ..n.....LU9y.0.. 0070 35 56 c2 f8 4a 7f e6 cc b3 19 ab 83 31 20 01 ae 5V..J.......1 .. 0080 06 4e 1e 02 34 5f 64 3e dc d1 6a a8 2f f1 83 d6 .N..4_d>..j./... 0090 20 2a 07 c4 aa 01 72 ae cf 72 29 1e 59 0c e2 fc *....r..r).Y... 00a0 a6 70 84 93 1c 56 3f 1c f7 ed a7 cf 9b 7b 97 86 .p...V?......{.. 00b0 36 82 f3 30 2c 1a 7f 3e 6f c3 3f 5d f2 2d b7 a4 6..0,..>o.?].-.. 00c0 47 ed f2 0a f8 84 b0 48 b9 25 e1 25 e4 5f 8f eb G......H.%.%._.. 00d0 c9 f0 7f d2 82 3e 9b bb fe 91 bd de c5 9b 5e 77 .....>........^w 00e0 d4 d9 fc f2 01 6b 14 1d 93 7f ec 50 f9 d3 5d b2 .....k.....P..]. 00f0 af e0 cb 83 85 a9 e0 0d 86 18 9e a0 43 70 71 d5 ............Cpq. 0100 5b cd af dd 0e 28 f7 9e 4e 58 39 d5 58 d0 35 6d [....(..NX9.X.5m 0110 4f c5 b3 3b 7a 02 49 ca fb b9 cc db 1c dc d5 1e O..;z.I......... 0120 50 1e 0f c1 36 54 a1 5f aa 3e 51 62 63 0d 0b 78 P...6T._.>Qbc..x 0130 67 93 4d 8e c5 2d 66 80 42 66 19 61 8e 3c d7 dd g.M..-f.Bf.a.<.. 0140 ff bf 01 72 f1 f3 d2 58 de 4e 1b 0c bf 58 cb 1d ...r...X.N...X.. 0150 75 35 47 d8 9a 11 ce 14 fe 39 dd ba 05 b0 47 f7 u5G......9....G. 0160 6e c0 c1 88 86 a8 8b 94 d0 6c 44 97 cf 50 7b 4f n........lD..P{O 0170 63 4c 99 de 1b 12 91 b0 f2 29 03 4b e5 27 02 4e cL.......).K.'.N 0180 7a 64 b6 7f 97 8c 34 36 56 71 fc dc cf 40 zd....46Vq...@