Frame 1 (226 bytes on wire, 226 bytes captured) Arrival Time: Aug 15, 2006 11:43:41.266578000 Time delta from previous packet: 0.000000000 seconds Time since reference or first frame: 0.000000000 seconds Frame Number: 1 Packet Length: 226 bytes Capture Length: 226 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa), Dst: 00:e0:7b:00:0d:61 (00:e0:7b:00:0d:61) Destination: 00:e0:7b:00:0d:61 (00:e0:7b:00:0d:61) Source: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa) Type: IP (0x0800) Frame check sequence: 0x9c9d7853 [correct] Internet Protocol, Src: 165.227.249.150 (165.227.249.150), Dst: 165.227.249.132 (165.227.249.132) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 208 Identification: 0x01c3 (451) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: UDP (0x11) Header checksum: 0xf977 [correct] Good: True Bad : False Source: 165.227.249.150 (165.227.249.150) Destination: 165.227.249.132 (165.227.249.132) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 188 Checksum: 0xb40f [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0x4398FF4914F4CAA3 Responder cookie: 0x0000000000000000 Next payload: Security Association (1) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 180 Security Association payload Next payload: Vendor ID (13) Length: 52 Domain of interpretation: IPSEC (1) Situation: IDENTITY (1) Proposal payload # 1 Next payload: NONE (0) Length: 40 Proposal number: 1 Protocol ID: ISAKMP (1) SPI size: 0 Number of transforms: 1 Transform payload # 1 Next payload: NONE (0) Length: 32 Transform number: 1 Transform ID: KEY_IKE (1) Encryption-Algorithm (1): 3DES-CBC (5) Hash-Algorithm (2): SHA (2) Group-Description (4): Alternate 1024-bit MODP group (2) Authentication-Method (3): PSK (1) Life-Type (11): Seconds (1) Life-Duration (12): Duration-Value (28800) Vendor ID payload Next payload: Vendor ID (13) Length: 20 Vendor ID: unknown vendor ID: 0x4A131C81070358455C5728F20E95452F Vendor ID payload Next payload: Vendor ID (13) Length: 20 Vendor ID: draft-ietf-ipsec-nat-t-ike-03 Vendor ID payload Next payload: Vendor ID (13) Length: 20 Vendor ID: draft-ietf-ipsec-nat-t-ike-02 Vendor ID payload Next payload: Vendor ID (13) Length: 20 Vendor ID: draft-ietf-ipsec-nat-t-ike-00 Vendor ID payload Next payload: NONE (0) Length: 20 Vendor ID: RFC 3706 Detecting Dead IKE Peers (DPD) 0000 00 e0 7b 00 0d 61 00 0c 29 96 e1 fa 08 00 45 00 ..{..a..).....E. 0010 00 d0 01 c3 00 00 80 11 f9 77 a5 e3 f9 96 a5 e3 .........w...... 0020 f9 84 01 f4 01 f4 00 bc b4 0f 43 98 ff 49 14 f4 ..........C..I.. 0030 ca a3 00 00 00 00 00 00 00 00 01 10 02 00 00 00 ................ 0040 00 00 00 00 00 b4 0d 00 00 34 00 00 00 01 00 00 .........4...... 0050 00 01 00 00 00 28 01 01 00 01 00 00 00 20 01 01 .....(....... .. 0060 00 00 80 01 00 05 80 02 00 02 80 04 00 02 80 03 ................ 0070 00 01 80 0b 00 01 80 0c 70 80 0d 00 00 14 4a 13 ........p.....J. 0080 1c 81 07 03 58 45 5c 57 28 f2 0e 95 45 2f 0d 00 ....XE\W(...E/.. 0090 00 14 7d 94 19 a6 53 10 ca 6f 2c 17 9d 92 15 52 ..}...S..o,....R 00a0 9d 56 0d 00 00 14 90 cb 80 91 3e bb 69 6e 08 63 .V........>.in.c 00b0 81 b5 ec 42 7b 1f 0d 00 00 14 44 85 15 2d 18 b6 ...B{.....D..-.. 00c0 bb cd 0b e8 a8 46 95 79 dd cc 00 00 00 14 af ca .....F.y........ 00d0 d7 13 68 a1 f1 c9 6b 86 96 fc 77 57 01 00 9c 9d ..h...k...wW.... 00e0 78 53 xS Frame 2 (158 bytes on wire, 158 bytes captured) Arrival Time: Aug 15, 2006 11:43:41.349953000 Time delta from previous packet: 0.083375000 seconds Time since reference or first frame: 0.083375000 seconds Frame Number: 2 Packet Length: 158 bytes Capture Length: 158 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:e0:7b:00:0d:61 (00:e0:7b:00:0d:61), Dst: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa) Destination: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa) Source: 00:e0:7b:00:0d:61 (00:e0:7b:00:0d:61) Type: IP (0x0800) Frame check sequence: 0x839acb4a [correct] Internet Protocol, Src: 165.227.249.132 (165.227.249.132), Dst: 165.227.249.150 (165.227.249.150) Version: 4 Header length: 20 bytes Differentiated Services Field: 0xe0 (DSCP 0x38: Class Selector 7; ECN: 0x00) 1110 00.. = Differentiated Services Codepoint: Class Selector 7 (0x38) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 140 Identification: 0x1688 (5768) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0x2417 [correct] Good: True Bad : False Source: 165.227.249.132 (165.227.249.132) Destination: 165.227.249.150 (165.227.249.150) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 120 Checksum: 0xc55a [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0x4398FF4914F4CAA3 Responder cookie: 0x1500D2402AAD4DD3 Next payload: Security Association (1) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 112 Security Association payload Next payload: Vendor ID (13) Length: 52 Domain of interpretation: IPSEC (1) Situation: IDENTITY (1) Proposal payload # 1 Next payload: NONE (0) Length: 40 Proposal number: 1 Protocol ID: ISAKMP (1) SPI size: 0 Number of transforms: 1 Transform payload # 1 Next payload: NONE (0) Length: 32 Transform number: 1 Transform ID: KEY_IKE (1) Encryption-Algorithm (1): 3DES-CBC (5) Hash-Algorithm (2): SHA (2) Group-Description (4): Alternate 1024-bit MODP group (2) Authentication-Method (3): PSK (1) Life-Type (11): Seconds (1) Life-Duration (12): Duration-Value (28800) Vendor ID payload Next payload: Vendor ID (13) Length: 12 Vendor ID: unknown vendor ID: 0x424E455300000007 Vendor ID payload Next payload: NONE (0) Length: 20 Vendor ID: RFC 3706 Detecting Dead IKE Peers (DPD) 0000 00 0c 29 96 e1 fa 00 e0 7b 00 0d 61 08 00 45 e0 ..).....{..a..E. 0010 00 8c 16 88 00 00 40 11 24 17 a5 e3 f9 84 a5 e3 ......@.$....... 0020 f9 96 01 f4 01 f4 00 78 c5 5a 43 98 ff 49 14 f4 .......x.ZC..I.. 0030 ca a3 15 00 d2 40 2a ad 4d d3 01 10 02 00 00 00 .....@*.M....... 0040 00 00 00 00 00 70 0d 00 00 34 00 00 00 01 00 00 .....p...4...... 0050 00 01 00 00 00 28 01 01 00 01 00 00 00 20 01 01 .....(....... .. 0060 00 00 80 01 00 05 80 02 00 02 80 04 00 02 80 03 ................ 0070 00 01 80 0b 00 01 80 0c 70 80 0d 00 00 0c 42 4e ........p.....BN 0080 45 53 00 00 00 07 00 00 00 14 af ca d7 13 68 a1 ES............h. 0090 f1 c9 6b 86 96 fc 77 57 01 00 83 9a cb 4a ..k...wW.....J Frame 3 (226 bytes on wire, 226 bytes captured) Arrival Time: Aug 15, 2006 11:43:41.442882000 Time delta from previous packet: 0.092929000 seconds Time since reference or first frame: 0.176304000 seconds Frame Number: 3 Packet Length: 226 bytes Capture Length: 226 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa), Dst: 00:e0:7b:00:0d:61 (00:e0:7b:00:0d:61) Destination: 00:e0:7b:00:0d:61 (00:e0:7b:00:0d:61) Source: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa) Type: IP (0x0800) Frame check sequence: 0x4c2219b0 [correct] Internet Protocol, Src: 165.227.249.150 (165.227.249.150), Dst: 165.227.249.132 (165.227.249.132) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 208 Identification: 0x01c4 (452) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: UDP (0x11) Header checksum: 0xf976 [correct] Good: True Bad : False Source: 165.227.249.150 (165.227.249.150) Destination: 165.227.249.132 (165.227.249.132) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 188 Checksum: 0x02aa [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0x4398FF4914F4CAA3 Responder cookie: 0x1500D2402AAD4DD3 Next payload: Key Exchange (4) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 180 Key Exchange payload Next payload: Nonce (10) Length: 132 Key Exchange Data Nonce payload Next payload: NONE (0) Length: 20 Nonce Data 0000 00 e0 7b 00 0d 61 00 0c 29 96 e1 fa 08 00 45 00 ..{..a..).....E. 0010 00 d0 01 c4 00 00 80 11 f9 76 a5 e3 f9 96 a5 e3 .........v...... 0020 f9 84 01 f4 01 f4 00 bc 02 aa 43 98 ff 49 14 f4 ..........C..I.. 0030 ca a3 15 00 d2 40 2a ad 4d d3 04 10 02 00 00 00 .....@*.M....... 0040 00 00 00 00 00 b4 0a 00 00 84 ee 93 a9 8c fa 29 ...............) 0050 dc 3c ae 89 1e da 4b 04 b7 34 7b be 91 76 72 0f .<....K..4{..vr. 0060 c0 c7 24 ca bd f6 d9 de cf b7 40 fb 22 21 4c 3c ..$.......@."!L< 0070 bd 02 59 e5 fd 9d d9 ea aa e0 bd 9f 0f 1a 31 0a ..Y...........1. 0080 71 a7 be b3 24 c4 07 d9 95 b5 40 48 4c 02 06 2f q...$.....@HL../ 0090 96 86 41 48 fa 8b 97 e6 bb ec 06 c2 94 0d ff 52 ..AH...........R 00a0 0a d1 fc c6 a8 c3 42 89 4a f8 16 af 91 12 55 6f ......B.J.....Uo 00b0 5e a6 0a 8b 09 ca 7f af fb 94 e3 c0 63 c4 c3 64 ^...........c..d 00c0 20 0f 0c 68 43 cc bc ad b3 47 00 00 00 14 9f 0b ..hC....G...... 00d0 22 3f 4e 9a 33 ca 52 0a e2 2b d2 e7 2f bd 4c 22 "?N.3.R..+../.L" 00e0 19 b0 .. Frame 4 (230 bytes on wire, 230 bytes captured) Arrival Time: Aug 15, 2006 11:43:41.619532000 Time delta from previous packet: 0.176650000 seconds Time since reference or first frame: 0.352954000 seconds Frame Number: 4 Packet Length: 230 bytes Capture Length: 230 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:e0:7b:00:0d:61 (00:e0:7b:00:0d:61), Dst: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa) Destination: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa) Source: 00:e0:7b:00:0d:61 (00:e0:7b:00:0d:61) Type: IP (0x0800) Frame check sequence: 0xca618412 [correct] Internet Protocol, Src: 165.227.249.132 (165.227.249.132), Dst: 165.227.249.150 (165.227.249.150) Version: 4 Header length: 20 bytes Differentiated Services Field: 0xe0 (DSCP 0x38: Class Selector 7; ECN: 0x00) 1110 00.. = Differentiated Services Codepoint: Class Selector 7 (0x38) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 212 Identification: 0x168a (5770) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0x23cd [correct] Good: True Bad : False Source: 165.227.249.132 (165.227.249.132) Destination: 165.227.249.150 (165.227.249.150) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 192 Checksum: 0x174e [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0x4398FF4914F4CAA3 Responder cookie: 0x1500D2402AAD4DD3 Next payload: Key Exchange (4) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 184 Key Exchange payload Next payload: Nonce (10) Length: 132 Key Exchange Data Nonce payload Next payload: NONE (0) Length: 24 Nonce Data 0000 00 0c 29 96 e1 fa 00 e0 7b 00 0d 61 08 00 45 e0 ..).....{..a..E. 0010 00 d4 16 8a 00 00 40 11 23 cd a5 e3 f9 84 a5 e3 ......@.#....... 0020 f9 96 01 f4 01 f4 00 c0 17 4e 43 98 ff 49 14 f4 .........NC..I.. 0030 ca a3 15 00 d2 40 2a ad 4d d3 04 10 02 00 00 00 .....@*.M....... 0040 00 00 00 00 00 b8 0a 00 00 84 1a 53 7f 32 c8 aa ...........S.2.. 0050 61 48 85 a0 cb 19 a8 69 1c 8a 14 7a 03 22 8e a1 aH.....i...z.".. 0060 40 ca 5c 1e 06 c5 bd ea f7 af 93 e2 f8 8d 62 c8 @.\...........b. 0070 6c 51 fd 32 6e f5 fc 0f 70 0c 36 53 bb 43 38 82 lQ.2n...p.6S.C8. 0080 d2 20 b9 fd 85 ee c6 27 60 99 6f 79 2a d9 8c c4 . .....'`.oy*... 0090 21 2e 74 9c 94 d0 2e 39 60 0d ba 08 da bb 69 4b !.t....9`.....iK 00a0 c2 3b 8d 99 b1 1a 85 5c 3e 33 4f 83 e3 ad 54 06 .;.....\>3O...T. 00b0 25 19 c8 50 e8 77 02 59 3f 4f 02 a8 c9 58 d2 4a %..P.w.Y?O...X.J 00c0 ed 3b e7 e6 ba 4f 64 a9 bf a5 00 00 00 18 5b 1d .;...Od.......[. 00d0 93 1b df ea 3b 54 4e aa 65 50 7b c9 02 41 44 d2 ....;TN.eP{..AD. 00e0 8d ab ca 61 84 12 ...a.. Frame 5 (146 bytes on wire, 146 bytes captured) Arrival Time: Aug 15, 2006 11:43:41.762923000 Time delta from previous packet: 0.143391000 seconds Time since reference or first frame: 0.496345000 seconds Frame Number: 5 Packet Length: 146 bytes Capture Length: 146 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa), Dst: 00:e0:7b:00:0d:61 (00:e0:7b:00:0d:61) Destination: 00:e0:7b:00:0d:61 (00:e0:7b:00:0d:61) Source: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa) Type: IP (0x0800) Frame check sequence: 0x783065d6 [correct] Internet Protocol, Src: 165.227.249.150 (165.227.249.150), Dst: 165.227.249.132 (165.227.249.132) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 128 Identification: 0x01c5 (453) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: UDP (0x11) Header checksum: 0xf9c5 [correct] Good: True Bad : False Source: 165.227.249.150 (165.227.249.150) Destination: 165.227.249.132 (165.227.249.132) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 108 Checksum: 0xea13 [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0x4398FF4914F4CAA3 Responder cookie: 0x1500D2402AAD4DD3 Next payload: Identification (5) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 100 Encrypted payload (72 bytes) 0000 00 e0 7b 00 0d 61 00 0c 29 96 e1 fa 08 00 45 00 ..{..a..).....E. 0010 00 80 01 c5 00 00 80 11 f9 c5 a5 e3 f9 96 a5 e3 ................ 0020 f9 84 01 f4 01 f4 00 6c ea 13 43 98 ff 49 14 f4 .......l..C..I.. 0030 ca a3 15 00 d2 40 2a ad 4d d3 05 10 02 01 00 00 .....@*.M....... 0040 00 00 00 00 00 64 b8 53 64 ce 0b c2 a9 ae b1 8f .....d.Sd....... 0050 9f 17 c9 03 ba 9e 68 94 01 cc a3 7f f5 5c cb 64 ......h......\.d 0060 4f 79 de 2d b1 91 c1 1d d7 51 93 6a 4d 1d 2a dd Oy.-.....Q.jM.*. 0070 24 ca a2 85 6a dd 9a 73 05 2a 45 2d 9c b1 87 be $...j..s.*E-.... 0080 f8 ab 4b 38 a8 7f 72 24 c8 6e 51 fc 9b 9f 78 30 ..K8..r$.nQ...x0 0090 65 d6 e. Frame 6 (138 bytes on wire, 138 bytes captured) Arrival Time: Aug 15, 2006 11:43:41.822880000 Time delta from previous packet: 0.059957000 seconds Time since reference or first frame: 0.556302000 seconds Frame Number: 6 Packet Length: 138 bytes Capture Length: 138 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:e0:7b:00:0d:61 (00:e0:7b:00:0d:61), Dst: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa) Destination: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa) Source: 00:e0:7b:00:0d:61 (00:e0:7b:00:0d:61) Type: IP (0x0800) Frame check sequence: 0x8513d8a9 [correct] Internet Protocol, Src: 165.227.249.132 (165.227.249.132), Dst: 165.227.249.150 (165.227.249.150) Version: 4 Header length: 20 bytes Differentiated Services Field: 0xe0 (DSCP 0x38: Class Selector 7; ECN: 0x00) 1110 00.. = Differentiated Services Codepoint: Class Selector 7 (0x38) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 120 Identification: 0x16ac (5804) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0x2407 [correct] Good: True Bad : False Source: 165.227.249.132 (165.227.249.132) Destination: 165.227.249.150 (165.227.249.150) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 100 Checksum: 0xced8 [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0x4398FF4914F4CAA3 Responder cookie: 0x1500D2402AAD4DD3 Next payload: Identification (5) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 92 Encrypted payload (64 bytes) 0000 00 0c 29 96 e1 fa 00 e0 7b 00 0d 61 08 00 45 e0 ..).....{..a..E. 0010 00 78 16 ac 00 00 40 11 24 07 a5 e3 f9 84 a5 e3 .x....@.$....... 0020 f9 96 01 f4 01 f4 00 64 ce d8 43 98 ff 49 14 f4 .......d..C..I.. 0030 ca a3 15 00 d2 40 2a ad 4d d3 05 10 02 01 00 00 .....@*.M....... 0040 00 00 00 00 00 5c 0e cd 0b 7d 8c 19 ea 66 8b 5d .....\...}...f.] 0050 ec 94 f0 e9 14 d0 89 e4 3d a1 35 7a 28 95 70 e8 ........=.5z(.p. 0060 e9 3a dc fb c6 19 e3 43 da fb 8d c5 99 0d c0 74 .:.....C.......t 0070 a1 20 23 3b 41 c4 29 63 e1 13 86 68 ef 36 b0 19 . #;A.)c...h.6.. 0080 28 1e 97 12 97 8c 85 13 d8 a9 (......... Frame 7 (338 bytes on wire, 338 bytes captured) Arrival Time: Aug 15, 2006 11:43:41.943127000 Time delta from previous packet: 0.120247000 seconds Time since reference or first frame: 0.676549000 seconds Frame Number: 7 Packet Length: 338 bytes Capture Length: 338 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa), Dst: 00:e0:7b:00:0d:61 (00:e0:7b:00:0d:61) Destination: 00:e0:7b:00:0d:61 (00:e0:7b:00:0d:61) Source: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa) Type: IP (0x0800) Frame check sequence: 0x58adcf85 [correct] Internet Protocol, Src: 165.227.249.150 (165.227.249.150), Dst: 165.227.249.132 (165.227.249.132) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 320 Identification: 0x01c6 (454) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: UDP (0x11) Header checksum: 0xf904 [correct] Good: True Bad : False Source: 165.227.249.150 (165.227.249.150) Destination: 165.227.249.132 (165.227.249.132) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 300 Checksum: 0x8262 [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0x4398FF4914F4CAA3 Responder cookie: 0x1500D2402AAD4DD3 Next payload: Hash (8) Version: 1.0 Exchange type: Quick Mode (32) Flags .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x6DB6FBB9 Length: 292 Encrypted payload (264 bytes) 0000 00 e0 7b 00 0d 61 00 0c 29 96 e1 fa 08 00 45 00 ..{..a..).....E. 0010 01 40 01 c6 00 00 80 11 f9 04 a5 e3 f9 96 a5 e3 .@.............. 0020 f9 84 01 f4 01 f4 01 2c 82 62 43 98 ff 49 14 f4 .......,.bC..I.. 0030 ca a3 15 00 d2 40 2a ad 4d d3 08 10 20 01 6d b6 .....@*.M... .m. 0040 fb b9 00 00 01 24 1f 2e bd d2 d4 09 59 94 c7 1f .....$......Y... 0050 e7 72 6c 3d 2b ee 29 ba 68 e2 da 46 c4 a7 3c a8 .rl=+.).h..F..<. 0060 6b a4 cb 66 8b 86 ba a1 0d 6f 5f 36 a4 c5 ae 47 k..f.....o_6...G 0070 6b 70 7e 90 e9 34 1c 86 de 53 31 fa f5 1f 36 fe kp~..4...S1...6. 0080 15 a8 77 38 9e 5c 0c 97 10 bd e0 3c 71 4c 52 a1 ..w8.\......f...5..Y.... 00b0 ae 22 5a 89 3c d6 bf b5 cb f5 ea d1 27 d2 ad 95 ."Z.<.......'... 00c0 ee 09 a1 5e 43 26 3f a6 3b 1e cc 57 08 65 18 a1 ...^C&?.;..W.e.. 00d0 6c c8 cf 96 a2 e7 8d 6a 60 37 00 cd a5 11 b5 5a l......j`7.....Z 00e0 f2 c7 32 9d 22 c0 fd 30 03 b7 ca cd f2 03 5c 65 ..2."..0......\e 00f0 a3 cc c0 b2 be a1 a9 6d 4e fa 35 70 f2 cb a2 dc .......mN.5p.... 0100 a4 a8 96 5f 18 f0 16 d0 23 d5 82 23 3b ea 2e ed ..._....#..#;... 0110 cf 4c 27 bd bd 29 53 9c 52 5b 49 d3 68 69 5a bd .L'..)S.R[I.hiZ. 0120 e7 8e 64 f1 6b 90 20 da df 0f 02 1d 09 88 22 06 ..d.k. .......". 0130 4f 94 d5 6a 3b 31 e5 44 75 3a 18 62 ba 66 63 0c O..j;1.Du:.b.fc. 0140 97 c4 34 5a 45 b3 76 f4 fa 14 b5 6f 0a 55 58 ad ..4ZE.v....o.UX. 0150 cf 85 .. Frame 8 (338 bytes on wire, 338 bytes captured) Arrival Time: Aug 15, 2006 11:43:42.147323000 Time delta from previous packet: 0.204196000 seconds Time since reference or first frame: 0.880745000 seconds Frame Number: 8 Packet Length: 338 bytes Capture Length: 338 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:e0:7b:00:0d:61 (00:e0:7b:00:0d:61), Dst: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa) Destination: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa) Source: 00:e0:7b:00:0d:61 (00:e0:7b:00:0d:61) Type: IP (0x0800) Frame check sequence: 0xe75985ac [correct] Internet Protocol, Src: 165.227.249.132 (165.227.249.132), Dst: 165.227.249.150 (165.227.249.150) Version: 4 Header length: 20 bytes Differentiated Services Field: 0xe0 (DSCP 0x38: Class Selector 7; ECN: 0x00) 1110 00.. = Differentiated Services Codepoint: Class Selector 7 (0x38) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 320 Identification: 0x16b9 (5817) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0x2332 [correct] Good: True Bad : False Source: 165.227.249.132 (165.227.249.132) Destination: 165.227.249.150 (165.227.249.150) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 300 Checksum: 0xc64c [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0x4398FF4914F4CAA3 Responder cookie: 0x1500D2402AAD4DD3 Next payload: Hash (8) Version: 1.0 Exchange type: Quick Mode (32) Flags .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x6DB6FBB9 Length: 292 Encrypted payload (264 bytes) 0000 00 0c 29 96 e1 fa 00 e0 7b 00 0d 61 08 00 45 e0 ..).....{..a..E. 0010 01 40 16 b9 00 00 40 11 23 32 a5 e3 f9 84 a5 e3 .@....@.#2...... 0020 f9 96 01 f4 01 f4 01 2c c6 4c 43 98 ff 49 14 f4 .......,.LC..I.. 0030 ca a3 15 00 d2 40 2a ad 4d d3 08 10 20 01 6d b6 .....@*.M... .m. 0040 fb b9 00 00 01 24 21 ba 34 26 e9 2a 25 b4 1f 8e .....$!.4&.*%... 0050 22 f1 9d a8 62 9c ee 97 ff 86 e5 b4 46 61 bf 59 "...b.......Fa.Y 0060 ab 84 b8 91 f7 a0 b2 01 a5 b5 21 d4 58 eb f5 c0 ..........!.X... 0070 58 e7 b4 80 9a fc 01 58 4a f1 e1 18 f6 ec d6 f9 X......XJ....... 0080 2d 85 21 67 5b a0 4a 7a 93 d0 f2 7d 2c d3 a4 8e -.!g[.Jz...},... 0090 b4 35 2f 96 38 7d c7 4f 92 a7 78 80 63 47 8b e1 .5/.8}.O..x.cG.. 00a0 49 cb 8a 5e 16 10 e0 dc fb ea 8c 7c 43 f7 fa 09 I..^.......|C... 00b0 e0 e0 b4 82 d7 d8 30 58 9b b9 f7 7e 68 3e 79 85 ......0X...~h>y. 00c0 e3 56 42 40 a5 6f e0 43 e9 cc e9 5f b2 9b a2 76 .VB@.o.C..._...v 00d0 e8 b5 c5 15 3b 52 28 b0 b6 08 fd 1d 20 19 3b 9f ....;R(..... .;. 00e0 d5 b5 ce 93 2c 9a e0 78 e9 74 e3 b9 4f b4 d7 72 ....,..x.t..O..r 00f0 81 76 32 dc ce f1 d0 86 27 e2 0f 44 dc 26 87 94 .v2.....'..D.&.. 0100 cb b4 36 ab 51 5d 14 cf 13 fb e7 87 9b 2f 9e 16 ..6.Q]......./.. 0110 a7 f1 6e 38 6e 17 39 a3 00 56 55 bf fd e8 04 f3 ..n8n.9..VU..... 0120 0f e4 51 fb bf 15 29 b9 f6 1d ba 32 e1 16 f0 2a ..Q...)....2...* 0130 9b e6 6a f5 41 d1 9e 30 9b 97 47 6f c4 2b 93 f3 ..j.A..0..Go.+.. 0140 a5 83 be 41 e9 8d 4d 4e 42 8d 71 0a 4e fc e7 59 ...A..MNB.q.N..Y 0150 85 ac .. Frame 9 (106 bytes on wire, 106 bytes captured) Arrival Time: Aug 15, 2006 11:43:42.600433000 Time delta from previous packet: 0.453110000 seconds Time since reference or first frame: 1.333855000 seconds Frame Number: 9 Packet Length: 106 bytes Capture Length: 106 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa), Dst: 00:e0:7b:00:0d:61 (00:e0:7b:00:0d:61) Destination: 00:e0:7b:00:0d:61 (00:e0:7b:00:0d:61) Source: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa) Type: IP (0x0800) Frame check sequence: 0xf1d0014e [correct] Internet Protocol, Src: 165.227.249.150 (165.227.249.150), Dst: 165.227.249.132 (165.227.249.132) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 88 Identification: 0x01c7 (455) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: UDP (0x11) Header checksum: 0xf9eb [correct] Good: True Bad : False Source: 165.227.249.150 (165.227.249.150) Destination: 165.227.249.132 (165.227.249.132) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 68 Checksum: 0x7cf5 [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0x4398FF4914F4CAA3 Responder cookie: 0x1500D2402AAD4DD3 Next payload: Hash (8) Version: 1.0 Exchange type: Quick Mode (32) Flags .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x6DB6FBB9 Length: 60 Encrypted payload (32 bytes) 0000 00 e0 7b 00 0d 61 00 0c 29 96 e1 fa 08 00 45 00 ..{..a..).....E. 0010 00 58 01 c7 00 00 80 11 f9 eb a5 e3 f9 96 a5 e3 .X.............. 0020 f9 84 01 f4 01 f4 00 44 7c f5 43 98 ff 49 14 f4 .......D|.C..I.. 0030 ca a3 15 00 d2 40 2a ad 4d d3 08 10 20 01 6d b6 .....@*.M... .m. 0040 fb b9 00 00 00 3c 84 7a 2b ea 3a 01 e9 dc d8 cf .....<.z+.:..... 0050 20 6c ea 3e d6 f7 c3 1c 54 63 02 23 a8 ec 47 d5 l.>....Tc.#..G. 0060 0b bc 21 98 65 3e f1 d0 01 4e ..!.e>...N Frame 10 (402 bytes on wire, 402 bytes captured) Arrival Time: Aug 15, 2006 11:43:47.229919000 Time delta from previous packet: 4.629486000 seconds Time since reference or first frame: 5.963341000 seconds Frame Number: 10 Packet Length: 402 bytes Capture Length: 402 bytes Protocols in frame: eth:ip:esp:data Ethernet II, Src: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa), Dst: 00:e0:7b:00:0d:61 (00:e0:7b:00:0d:61) Destination: 00:e0:7b:00:0d:61 (00:e0:7b:00:0d:61) Source: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa) Type: IP (0x0800) Frame check sequence: 0x19c683d1 [correct] Internet Protocol, Src: 165.227.249.150 (165.227.249.150), Dst: 165.227.249.132 (165.227.249.132) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 384 Identification: 0x01c8 (456) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: ESP (0x32) Header checksum: 0xf8a1 [correct] Good: True Bad : False Source: 165.227.249.150 (165.227.249.150) Destination: 165.227.249.132 (165.227.249.132) Encapsulating Security Payload SPI: 0x00089a06 Sequence: 1 Data (356 bytes) 0000 00 e0 7b 00 0d 61 00 0c 29 96 e1 fa 08 00 45 00 ..{..a..).....E. 0010 01 80 01 c8 00 00 80 32 f8 a1 a5 e3 f9 96 a5 e3 .......2........ 0020 f9 84 00 08 9a 06 00 00 00 01 69 50 36 cb f3 06 ..........iP6... 0030 25 03 b8 6b 71 b9 bb d4 0b a7 36 37 ff f7 ef a8 %..kq.....67.... 0040 47 7a d8 37 43 86 3a 4f 84 64 df 85 63 02 1d bd Gz.7C.:O.d..c... 0050 e2 e0 1e 94 81 d1 5c b5 e4 0a 4b a7 25 a6 62 9b ......\...K.%.b. 0060 9c 9c 4c 3a b6 61 f9 30 bc 09 0d ca ea 49 8b bf ..L:.a.0.....I.. 0070 92 83 51 c4 c6 ff b1 fb c1 6b 75 07 1d e6 71 61 ..Q......ku...qa 0080 da 8f 8e e6 d7 34 b5 4b ae dd b1 04 98 cc 75 a3 .....4.K......u. 0090 c4 0b 3a 4c 32 c7 af e4 c6 a9 bd 28 d8 20 be ff ..:L2......(. .. 00a0 f0 16 7f 1c 00 d6 46 18 a5 31 c3 3c d2 05 15 f3 ......F..1.<.... 00b0 98 fb 33 4e c8 5e 86 ab 03 d5 b4 ba db 55 9e 40 ..3N.^.......U.@ 00c0 2b 7b e4 ea 50 75 d5 44 69 01 e8 4a b4 91 0f 48 +{..Pu.Di..J...H 00d0 1a 33 d4 bd 6d ca dd f6 32 0c ba 78 3c 94 69 dc .3..m...2..x<.i. 00e0 b3 15 ea 77 65 d9 07 c1 56 4d 57 26 34 42 5d be ...we...VMW&4B]. 00f0 77 e7 20 02 75 23 0b 28 00 c0 90 47 f8 f4 a6 e2 w. .u#.(...G.... 0100 bd aa 6e 82 b7 fb fe 71 9e 0e 3f 88 92 72 23 d7 ..n....q..?..r#. 0110 41 fb 15 2b f2 b7 61 55 ba ef df 13 91 00 fe 9b A..+..aU........ 0120 97 b6 94 38 13 9c 11 33 0d 1a af 8f 29 e6 68 8a ...8...3....).h. 0130 68 08 7b 4b 6b 3b 72 22 bb 8b ce c2 94 ca 1d 2b h.{Kk;r".......+ 0140 55 a1 51 77 6d d3 5f 82 44 96 1a f3 11 63 45 06 U.Qwm._.D....cE. 0150 30 55 54 e2 1b 68 8e 34 10 4c 30 68 67 b9 81 5d 0UT..h.4.L0hg..] 0160 ae 81 81 c7 3a 84 3f 9c dd c4 70 e8 eb e7 b4 47 ....:.?...p....G 0170 96 ac b9 9b 22 0e ad 27 15 cc 54 ca 66 ff 25 36 ...."..'..T.f.%6 0180 33 48 ef cf 13 2c ba e9 65 12 d2 3a ce 28 19 c6 3H...,..e..:.(.. 0190 83 d1 .. Frame 11 (402 bytes on wire, 402 bytes captured) Arrival Time: Aug 15, 2006 11:43:47.232840000 Time delta from previous packet: 0.002921000 seconds Time since reference or first frame: 5.966262000 seconds Frame Number: 11 Packet Length: 402 bytes Capture Length: 402 bytes Protocols in frame: eth:ip:esp:data Ethernet II, Src: 00:e0:7b:00:0d:61 (00:e0:7b:00:0d:61), Dst: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa) Destination: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa) Source: 00:e0:7b:00:0d:61 (00:e0:7b:00:0d:61) Type: IP (0x0800) Frame check sequence: 0xda1e230c [correct] Internet Protocol, Src: 165.227.249.132 (165.227.249.132), Dst: 165.227.249.150 (165.227.249.150) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 384 Identification: 0x16c9 (5833) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 255 Protocol: ESP (0x32) Header checksum: 0x64a0 [correct] Good: True Bad : False Source: 165.227.249.132 (165.227.249.132) Destination: 165.227.249.150 (165.227.249.150) Encapsulating Security Payload SPI: 0xf061ab1a Sequence: 1 Data (356 bytes) 0000 00 0c 29 96 e1 fa 00 e0 7b 00 0d 61 08 00 45 00 ..).....{..a..E. 0010 01 80 16 c9 00 00 ff 32 64 a0 a5 e3 f9 84 a5 e3 .......2d....... 0020 f9 96 f0 61 ab 1a 00 00 00 01 df 4b 13 d1 56 90 ...a.......K..V. 0030 37 ea 8e 37 d9 48 29 91 1f 66 5a de c6 ff 65 b8 7..7.H)..fZ...e. 0040 20 1f ce 62 7d f6 b4 87 38 80 57 65 71 6d 01 d6 ..b}...8.Weqm.. 0050 ef 71 e8 20 5a cb 76 54 74 90 5d 73 df 22 09 c1 .q. Z.vTt.]s.".. 0060 14 21 00 0c b5 78 ff c1 16 0b 57 4f cb 61 86 89 .!...x....WO.a.. 0070 29 c0 f9 9f b9 f6 81 ce 8a f0 72 21 10 57 e0 56 ).........r!.W.V 0080 b0 87 20 e0 ef a9 f3 a4 8b 69 01 70 55 16 91 f3 .. ......i.pU... 0090 6b 04 6f 57 9c 50 e9 bb 5b 29 09 bc 4e 3c 43 8a k.oW.P..[)..N.. 00b0 5d da 68 02 04 10 02 da 3a bf c6 7b 2c 13 7d 4d ].h.....:..{,.}M 00c0 0a a7 95 23 5d 8f cb 08 59 74 15 05 16 0e 36 80 ...#]...Yt....6. 00d0 db f8 09 ef d5 ac 0e 6b ea 1a e5 83 78 e1 45 d9 .......k....x.E. 00e0 93 4f 14 be 66 c1 9d 13 0b ef 9c 2f 9b 9a 4c 7b .O..f....../..L{ 00f0 23 37 d2 36 95 a6 f9 12 97 2e f0 78 d1 8d 86 b1 #7.6.......x.... 0100 aa 9e e6 a8 be ac 57 b9 c5 71 a0 e9 4a 51 30 9f ......W..q..JQ0. 0110 f5 65 30 a4 71 d1 d2 39 3a 39 e9 d9 74 e0 d3 ea .e0.q..9:9..t... 0120 35 0b 7c b7 4b 79 01 d6 0d e9 8b ad e2 a7 b0 a5 5.|.Ky.......... 0130 2b e0 ef a5 44 9d 37 77 4b 67 c4 8b 5e 22 23 80 +...D.7wKg..^"#. 0140 5f d6 da 93 a4 af b3 b1 ee 94 26 a9 3b 2e d0 c6 _.........&.;... 0150 2e 74 f7 9b 49 31 9b f1 5f cb 04 68 22 47 a3 02 .t..I1.._..h"G.. 0160 d2 9f a5 1c 79 6e ab 5a 19 da 0c c7 d5 39 80 a1 ....yn.Z.....9.. 0170 95 d8 f1 cd 4c 91 ea 3a 2c d5 05 a0 40 e0 aa 5f ....L..:,...@.._ 0180 37 2c 88 cd a3 b5 0f d7 c4 22 7b 02 64 86 da 1e 7,......."{.d... 0190 23 0c #.