Frame 1 (222 bytes on wire, 222 bytes captured) Arrival Time: Aug 14, 2006 12:38:22.008168000 Time delta from previous packet: 0.000000000 seconds Time since reference or first frame: 0.000000000 seconds Frame Number: 1 Packet Length: 222 bytes Capture Length: 222 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa), Dst: 00:0c:41:90:f1:c1 (00:0c:41:90:f1:c1) Destination: 00:0c:41:90:f1:c1 (00:0c:41:90:f1:c1) Source: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.150 (165.227.249.150), Dst: 165.227.249.133 (165.227.249.133) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 208 Identification: 0x01c7 (455) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: UDP (0x11) Header checksum: 0xf972 [correct] Good: True Bad : False Source: 165.227.249.150 (165.227.249.150) Destination: 165.227.249.133 (165.227.249.133) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 188 Checksum: 0x714b [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0xD20780F7A3976EA6 Responder cookie: 0x0000000000000000 Next payload: Security Association (1) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 180 Security Association payload Next payload: Vendor ID (13) Length: 52 Domain of interpretation: IPSEC (1) Situation: IDENTITY (1) Proposal payload # 1 Next payload: NONE (0) Length: 40 Proposal number: 1 Protocol ID: ISAKMP (1) SPI size: 0 Number of transforms: 1 Transform payload # 1 Next payload: NONE (0) Length: 32 Transform number: 1 Transform ID: KEY_IKE (1) Encryption-Algorithm (1): 3DES-CBC (5) Hash-Algorithm (2): SHA (2) Group-Description (4): Alternate 1024-bit MODP group (2) Authentication-Method (3): PSK (1) Life-Type (11): Seconds (1) Life-Duration (12): Duration-Value (28800) Vendor ID payload Next payload: Vendor ID (13) Length: 20 Vendor ID: unknown vendor ID: 0x4A131C81070358455C5728F20E95452F Vendor ID payload Next payload: Vendor ID (13) Length: 20 Vendor ID: draft-ietf-ipsec-nat-t-ike-03 Vendor ID payload Next payload: Vendor ID (13) Length: 20 Vendor ID: draft-ietf-ipsec-nat-t-ike-02 Vendor ID payload Next payload: Vendor ID (13) Length: 20 Vendor ID: draft-ietf-ipsec-nat-t-ike-00 Vendor ID payload Next payload: NONE (0) Length: 20 Vendor ID: RFC 3706 Detecting Dead IKE Peers (DPD) 0000 00 0c 41 90 f1 c1 00 0c 29 96 e1 fa 08 00 45 00 ..A.....).....E. 0010 00 d0 01 c7 00 00 80 11 f9 72 a5 e3 f9 96 a5 e3 .........r...... 0020 f9 85 01 f4 01 f4 00 bc 71 4b d2 07 80 f7 a3 97 ........qK...... 0030 6e a6 00 00 00 00 00 00 00 00 01 10 02 00 00 00 n............... 0040 00 00 00 00 00 b4 0d 00 00 34 00 00 00 01 00 00 .........4...... 0050 00 01 00 00 00 28 01 01 00 01 00 00 00 20 01 01 .....(....... .. 0060 00 00 80 01 00 05 80 02 00 02 80 04 00 02 80 03 ................ 0070 00 01 80 0b 00 01 80 0c 70 80 0d 00 00 14 4a 13 ........p.....J. 0080 1c 81 07 03 58 45 5c 57 28 f2 0e 95 45 2f 0d 00 ....XE\W(...E/.. 0090 00 14 7d 94 19 a6 53 10 ca 6f 2c 17 9d 92 15 52 ..}...S..o,....R 00a0 9d 56 0d 00 00 14 90 cb 80 91 3e bb 69 6e 08 63 .V........>.in.c 00b0 81 b5 ec 42 7b 1f 0d 00 00 14 44 85 15 2d 18 b6 ...B{.....D..-.. 00c0 bb cd 0b e8 a8 46 95 79 dd cc 00 00 00 14 af ca .....F.y........ 00d0 d7 13 68 a1 f1 c9 6b 86 96 fc 77 57 01 00 ..h...k...wW.. Frame 2 (122 bytes on wire, 122 bytes captured) Arrival Time: Aug 14, 2006 12:38:22.023739000 Time delta from previous packet: 0.015571000 seconds Time since reference or first frame: 0.015571000 seconds Frame Number: 2 Packet Length: 122 bytes Capture Length: 122 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:0c:41:90:f1:c1 (00:0c:41:90:f1:c1), Dst: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa) Destination: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa) Source: 00:0c:41:90:f1:c1 (00:0c:41:90:f1:c1) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.133 (165.227.249.133), Dst: 165.227.249.150 (165.227.249.150) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 108 Identification: 0x0000 (0) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfb9d [correct] Good: True Bad : False Source: 165.227.249.133 (165.227.249.133) Destination: 165.227.249.150 (165.227.249.150) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 88 Checksum: 0x33a5 [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0xD20780F7A3976EA6 Responder cookie: 0x9A0E95EF50C02C41 Next payload: Security Association (1) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 80 Security Association payload Next payload: NONE (0) Length: 52 Domain of interpretation: IPSEC (1) Situation: IDENTITY (1) Proposal payload # 1 Next payload: NONE (0) Length: 40 Proposal number: 1 Protocol ID: ISAKMP (1) SPI size: 0 Number of transforms: 1 Transform payload # 1 Next payload: NONE (0) Length: 32 Transform number: 1 Transform ID: KEY_IKE (1) Encryption-Algorithm (1): 3DES-CBC (5) Hash-Algorithm (2): SHA (2) Group-Description (4): Alternate 1024-bit MODP group (2) Authentication-Method (3): PSK (1) Life-Type (11): Seconds (1) Life-Duration (12): Duration-Value (28800) 0000 00 0c 29 96 e1 fa 00 0c 41 90 f1 c1 08 00 45 00 ..).....A.....E. 0010 00 6c 00 00 40 00 40 11 fb 9d a5 e3 f9 85 a5 e3 .l..@.@......... 0020 f9 96 01 f4 01 f4 00 58 33 a5 d2 07 80 f7 a3 97 .......X3....... 0030 6e a6 9a 0e 95 ef 50 c0 2c 41 01 10 02 00 00 00 n.....P.,A...... 0040 00 00 00 00 00 50 00 00 00 34 00 00 00 01 00 00 .....P...4...... 0050 00 01 00 00 00 28 01 01 00 01 00 00 00 20 01 01 .....(....... .. 0060 00 00 80 01 00 05 80 02 00 02 80 04 00 02 80 03 ................ 0070 00 01 80 0b 00 01 80 0c 70 80 ........p. Frame 3 (222 bytes on wire, 222 bytes captured) Arrival Time: Aug 14, 2006 12:38:22.043014000 Time delta from previous packet: 0.019275000 seconds Time since reference or first frame: 0.034846000 seconds Frame Number: 3 Packet Length: 222 bytes Capture Length: 222 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa), Dst: 00:0c:41:90:f1:c1 (00:0c:41:90:f1:c1) Destination: 00:0c:41:90:f1:c1 (00:0c:41:90:f1:c1) Source: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.150 (165.227.249.150), Dst: 165.227.249.133 (165.227.249.133) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 208 Identification: 0x01c8 (456) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: UDP (0x11) Header checksum: 0xf971 [correct] Good: True Bad : False Source: 165.227.249.150 (165.227.249.150) Destination: 165.227.249.133 (165.227.249.133) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 188 Checksum: 0xb865 [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0xD20780F7A3976EA6 Responder cookie: 0x9A0E95EF50C02C41 Next payload: Key Exchange (4) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 180 Key Exchange payload Next payload: Nonce (10) Length: 132 Key Exchange Data Nonce payload Next payload: NONE (0) Length: 20 Nonce Data 0000 00 0c 41 90 f1 c1 00 0c 29 96 e1 fa 08 00 45 00 ..A.....).....E. 0010 00 d0 01 c8 00 00 80 11 f9 71 a5 e3 f9 96 a5 e3 .........q...... 0020 f9 85 01 f4 01 f4 00 bc b8 65 d2 07 80 f7 a3 97 .........e...... 0030 6e a6 9a 0e 95 ef 50 c0 2c 41 04 10 02 00 00 00 n.....P.,A...... 0040 00 00 00 00 00 b4 0a 00 00 84 a2 88 95 af fa de ................ 0050 73 ac 0e ba 0e dc 73 ea 9b cf ac 58 6e f0 13 67 s.....s....Xn..g 0060 5a db 1b 75 2d b4 e6 24 0e a7 10 c4 02 90 b0 2b Z..u-..$.......+ 0070 2b aa 31 7f a1 06 6c cf 94 ce c0 0a f8 e1 3b 57 +.1...l.......;W 0080 53 86 9b f2 a2 71 8d c5 36 65 43 f6 c2 ab a1 5b S....q..6eC....[ 0090 94 98 ee 03 6b 32 12 a0 c5 ab 22 46 3a 49 9d 88 ....k2...."F:I.. 00a0 77 85 28 2e 50 6a a1 37 ff 51 5b 4a da 08 4f bf w.(.Pj.7.Q[J..O. 00b0 f6 0b 90 d0 fd 4e 80 7f 68 d5 48 8c c1 0d be 2b .....N..h.H....+ 00c0 b8 17 21 b9 b6 b1 98 c3 2c c6 00 00 00 14 6c 62 ..!.....,.....lb 00d0 ed 2b ae 58 79 7f cc 9a 74 fe 63 6f 06 c4 .+.Xy...t.co.. Frame 4 (222 bytes on wire, 222 bytes captured) Arrival Time: Aug 14, 2006 12:38:22.222949000 Time delta from previous packet: 0.179935000 seconds Time since reference or first frame: 0.214781000 seconds Frame Number: 4 Packet Length: 222 bytes Capture Length: 222 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:0c:41:90:f1:c1 (00:0c:41:90:f1:c1), Dst: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa) Destination: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa) Source: 00:0c:41:90:f1:c1 (00:0c:41:90:f1:c1) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.133 (165.227.249.133), Dst: 165.227.249.150 (165.227.249.150) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 208 Identification: 0x0000 (0) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfb39 [correct] Good: True Bad : False Source: 165.227.249.133 (165.227.249.133) Destination: 165.227.249.150 (165.227.249.150) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 188 Checksum: 0xd80f [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0xD20780F7A3976EA6 Responder cookie: 0x9A0E95EF50C02C41 Next payload: Key Exchange (4) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 180 Key Exchange payload Next payload: Nonce (10) Length: 132 Key Exchange Data Nonce payload Next payload: NONE (0) Length: 20 Nonce Data 0000 00 0c 29 96 e1 fa 00 0c 41 90 f1 c1 08 00 45 00 ..).....A.....E. 0010 00 d0 00 00 40 00 40 11 fb 39 a5 e3 f9 85 a5 e3 ....@.@..9...... 0020 f9 96 01 f4 01 f4 00 bc d8 0f d2 07 80 f7 a3 97 ................ 0030 6e a6 9a 0e 95 ef 50 c0 2c 41 04 10 02 00 00 00 n.....P.,A...... 0040 00 00 00 00 00 b4 0a 00 00 84 2f d6 85 38 d2 82 ........../..8.. 0050 f1 5b 1e ea 42 13 6d 0e dc 09 a7 f3 61 0d 59 97 .[..B.m.....a.Y. 0060 86 21 39 03 c7 a3 b9 e9 f3 2a 3c e4 bc 6e 26 c9 .!9......*<..n&. 0070 19 72 ab 5b ea 7b 48 5a a0 f4 3b 97 c6 1e 19 fc .r.[.{HZ..;..... 0080 7d 9b d7 ba c0 09 f7 9a 93 b8 88 ba 6d 41 1d a3 }...........mA.. 0090 fb d6 b1 55 f2 89 9a 1e c9 ad 8a 5c b8 9a c7 a1 ...U.......\.... 00a0 c8 fd 56 9f 79 ce 99 3a a6 db 1c 62 c6 81 dc e7 ..V.y..:...b.... 00b0 88 dc 65 1d d3 f7 45 33 95 03 0f 0e f7 6f e1 55 ..e...E3.....o.U 00c0 e5 77 1f 38 ad 64 b2 a2 90 93 00 00 00 14 cf 25 .w.8.d.........% 00d0 ff fd 6d b6 ee fd d3 00 2f 3f c9 98 65 6d ..m...../?..em Frame 5 (142 bytes on wire, 142 bytes captured) Arrival Time: Aug 14, 2006 12:38:22.262407000 Time delta from previous packet: 0.039458000 seconds Time since reference or first frame: 0.254239000 seconds Frame Number: 5 Packet Length: 142 bytes Capture Length: 142 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa), Dst: 00:0c:41:90:f1:c1 (00:0c:41:90:f1:c1) Destination: 00:0c:41:90:f1:c1 (00:0c:41:90:f1:c1) Source: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.150 (165.227.249.150), Dst: 165.227.249.133 (165.227.249.133) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 128 Identification: 0x01c9 (457) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: UDP (0x11) Header checksum: 0xf9c0 [correct] Good: True Bad : False Source: 165.227.249.150 (165.227.249.150) Destination: 165.227.249.133 (165.227.249.133) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 108 Checksum: 0x8772 [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0xD20780F7A3976EA6 Responder cookie: 0x9A0E95EF50C02C41 Next payload: Identification (5) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 100 Encrypted payload (72 bytes) 0000 00 0c 41 90 f1 c1 00 0c 29 96 e1 fa 08 00 45 00 ..A.....).....E. 0010 00 80 01 c9 00 00 80 11 f9 c0 a5 e3 f9 96 a5 e3 ................ 0020 f9 85 01 f4 01 f4 00 6c 87 72 d2 07 80 f7 a3 97 .......l.r...... 0030 6e a6 9a 0e 95 ef 50 c0 2c 41 05 10 02 01 00 00 n.....P.,A...... 0040 00 00 00 00 00 64 c5 32 01 0f 15 f5 1f 6a 76 1d .....d.2.....jv. 0050 77 49 bf ab 87 10 e3 1a 6d 39 23 30 86 21 8b 04 wI......m9#0.!.. 0060 3e e9 7a 0e 2f b6 7d 64 db 61 b0 87 e6 6b 18 bc >.z./.}d.a...k.. 0070 b7 70 3f ee 5d 67 7b 3e d3 70 c3 c5 d6 87 99 2a .p?.]g{>.p.....* 0080 d8 62 f1 2b e9 9e 5a 38 5e a5 c7 f0 6a a9 .b.+..Z8^...j. Frame 6 (110 bytes on wire, 110 bytes captured) Arrival Time: Aug 14, 2006 12:38:22.284130000 Time delta from previous packet: 0.021723000 seconds Time since reference or first frame: 0.275962000 seconds Frame Number: 6 Packet Length: 110 bytes Capture Length: 110 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:0c:41:90:f1:c1 (00:0c:41:90:f1:c1), Dst: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa) Destination: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa) Source: 00:0c:41:90:f1:c1 (00:0c:41:90:f1:c1) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.133 (165.227.249.133), Dst: 165.227.249.150 (165.227.249.150) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 96 Identification: 0x0000 (0) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfba9 [correct] Good: True Bad : False Source: 165.227.249.133 (165.227.249.133) Destination: 165.227.249.150 (165.227.249.150) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 76 Checksum: 0x6a65 [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0xD20780F7A3976EA6 Responder cookie: 0x9A0E95EF50C02C41 Next payload: Identification (5) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 68 Encrypted payload (40 bytes) 0000 00 0c 29 96 e1 fa 00 0c 41 90 f1 c1 08 00 45 00 ..).....A.....E. 0010 00 60 00 00 40 00 40 11 fb a9 a5 e3 f9 85 a5 e3 .`..@.@......... 0020 f9 96 01 f4 01 f4 00 4c 6a 65 d2 07 80 f7 a3 97 .......Lje...... 0030 6e a6 9a 0e 95 ef 50 c0 2c 41 05 10 02 01 00 00 n.....P.,A...... 0040 00 00 00 00 00 44 1a a2 b6 a7 e0 68 72 fc b2 57 .....D.....hr..W 0050 c8 e7 e6 da 15 bd 5d ec 7a 49 7b 1a b9 f0 c4 cf ......].zI{..... 0060 9d e3 4a ff ff e5 15 ef fd fb fa 29 d3 1d ..J........).. Frame 7 (334 bytes on wire, 334 bytes captured) Arrival Time: Aug 14, 2006 12:38:22.314792000 Time delta from previous packet: 0.030662000 seconds Time since reference or first frame: 0.306624000 seconds Frame Number: 7 Packet Length: 334 bytes Capture Length: 334 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa), Dst: 00:0c:41:90:f1:c1 (00:0c:41:90:f1:c1) Destination: 00:0c:41:90:f1:c1 (00:0c:41:90:f1:c1) Source: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.150 (165.227.249.150), Dst: 165.227.249.133 (165.227.249.133) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 320 Identification: 0x01ca (458) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: UDP (0x11) Header checksum: 0xf8ff [correct] Good: True Bad : False Source: 165.227.249.150 (165.227.249.150) Destination: 165.227.249.133 (165.227.249.133) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 300 Checksum: 0xedba [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0xD20780F7A3976EA6 Responder cookie: 0x9A0E95EF50C02C41 Next payload: Hash (8) Version: 1.0 Exchange type: Quick Mode (32) Flags .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0xF46D9A0F Length: 292 Encrypted payload (264 bytes) 0000 00 0c 41 90 f1 c1 00 0c 29 96 e1 fa 08 00 45 00 ..A.....).....E. 0010 01 40 01 ca 00 00 80 11 f8 ff a5 e3 f9 96 a5 e3 .@.............. 0020 f9 85 01 f4 01 f4 01 2c ed ba d2 07 80 f7 a3 97 .......,........ 0030 6e a6 9a 0e 95 ef 50 c0 2c 41 08 10 20 01 f4 6d n.....P.,A.. ..m 0040 9a 0f 00 00 01 24 f3 fa 6f a4 5c 8b 5f 29 2b 08 .....$..o.\._)+. 0050 f7 77 08 0f cb 5d 26 8a 36 dd 70 bb a8 10 12 75 .w...]&.6.p....u 0060 6c d1 68 ce a6 e6 58 f1 88 d6 fe a6 6e 19 57 aa l.h...X.....n.W. 0070 1c 66 3c f6 ca dd dc 3a d2 c7 cb ab 48 f4 69 c4 .f<....:....H.i. 0080 0b 3e 32 27 e0 e9 ff ef 5a 8a 6c 1e be 0b 14 5e .>2'....Z.l....^ 0090 b9 4c 59 ed 90 f6 e5 22 80 ad 69 c8 ba ec e7 4d .LY...."..i....M 00a0 22 84 45 23 40 7e 49 7f 12 35 6a 2b 40 21 e1 0c ".E#@~I..5j+@!.. 00b0 3c 1e bf 7e 7e 32 93 b5 49 d4 e0 90 0f e4 e1 1b <..~~2..I....... 00c0 1b 04 93 a7 52 c2 f1 d4 55 dd 62 3f 85 bc b0 8e ....R...U.b?.... 00d0 a6 5f 5f 55 5d 4a 39 0a c9 1f 86 71 c6 bc 3d ce .__U]J9....q..=. 00e0 d4 72 f0 a7 b9 88 f2 1a a5 cd a9 cb 5f cf 5e 23 .r.........._.^# 00f0 1c 8c f4 cc 12 32 fa 7b 3e 1f 58 53 d2 8a 54 02 .....2.{>.XS..T. 0100 cf a9 8d 1a 31 ee a8 ca a5 3d 82 e7 40 ee 5e 3c ....1....=..@.^< 0110 16 25 5e 33 f8 6a d6 7b a0 ef 8c 5d d1 a9 5f c2 .%^3.j.{...].._. 0120 3c 20 57 9e 0e 58 fd b7 0b 8f 34 30 2d b9 95 5a < W..X....40-..Z 0130 90 39 5b 7f 01 33 52 17 5b 53 c1 e9 91 40 8d 31 .9[..3R.[S...@.1 0140 04 bb 77 ce 10 63 f8 fa 65 0a 9d 98 f9 a1 ..w..c..e..... Frame 8 (326 bytes on wire, 326 bytes captured) Arrival Time: Aug 14, 2006 12:38:22.530234000 Time delta from previous packet: 0.215442000 seconds Time since reference or first frame: 0.522066000 seconds Frame Number: 8 Packet Length: 326 bytes Capture Length: 326 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:0c:41:90:f1:c1 (00:0c:41:90:f1:c1), Dst: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa) Destination: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa) Source: 00:0c:41:90:f1:c1 (00:0c:41:90:f1:c1) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.133 (165.227.249.133), Dst: 165.227.249.150 (165.227.249.150) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 312 Identification: 0x0000 (0) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfad1 [correct] Good: True Bad : False Source: 165.227.249.133 (165.227.249.133) Destination: 165.227.249.150 (165.227.249.150) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 292 Checksum: 0x3c4b [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0xD20780F7A3976EA6 Responder cookie: 0x9A0E95EF50C02C41 Next payload: Hash (8) Version: 1.0 Exchange type: Quick Mode (32) Flags .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0xF46D9A0F Length: 284 Encrypted payload (256 bytes) 0000 00 0c 29 96 e1 fa 00 0c 41 90 f1 c1 08 00 45 00 ..).....A.....E. 0010 01 38 00 00 40 00 40 11 fa d1 a5 e3 f9 85 a5 e3 .8..@.@......... 0020 f9 96 01 f4 01 f4 01 24 3c 4b d2 07 80 f7 a3 97 .......$. 0050 2a 38 8c a4 b4 ee 1a bd 19 77 e9 5c 82 54 69 cd *8.......w.\.Ti. 0060 c7 7d 01 c1 f6 07 .}.... Frame 10 (398 bytes on wire, 398 bytes captured) Arrival Time: Aug 14, 2006 12:38:30.749687000 Time delta from previous packet: 8.013968000 seconds Time since reference or first frame: 8.741519000 seconds Frame Number: 10 Packet Length: 398 bytes Capture Length: 398 bytes Protocols in frame: eth:ip:esp:data Ethernet II, Src: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa), Dst: 00:0c:41:90:f1:c1 (00:0c:41:90:f1:c1) Destination: 00:0c:41:90:f1:c1 (00:0c:41:90:f1:c1) Source: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.150 (165.227.249.150), Dst: 165.227.249.133 (165.227.249.133) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 384 Identification: 0x01cc (460) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: ESP (0x32) Header checksum: 0xf89c [correct] Good: True Bad : False Source: 165.227.249.150 (165.227.249.150) Destination: 165.227.249.133 (165.227.249.133) Encapsulating Security Payload SPI: 0x59d5f672 Sequence: 1 Data (356 bytes) 0000 00 0c 41 90 f1 c1 00 0c 29 96 e1 fa 08 00 45 00 ..A.....).....E. 0010 01 80 01 cc 00 00 80 32 f8 9c a5 e3 f9 96 a5 e3 .......2........ 0020 f9 85 59 d5 f6 72 00 00 00 01 fd 40 96 a5 a2 81 ..Y..r.....@.... 0030 79 71 81 c3 5d dc 5d a0 69 f1 8f 83 c3 44 47 a4 yq..].].i....DG. 0040 4f 31 7b 3f da 74 e3 40 32 65 e4 87 ea 7f 86 d7 O1{?.t.@2e...... 0050 99 29 2b 2d 40 9e f8 46 bc 22 f0 f5 5c c7 18 08 .)+-@..F."..\... 0060 5e 9a ab 82 c2 ff 9b 2a 77 44 9a eb d6 e2 22 5e ^......*wD...."^ 0070 90 8d 28 84 ed 5a b6 48 cc c5 b6 60 95 3f 76 ae ..(..Z.H...`.?v. 0080 57 30 08 c8 83 62 88 ab cc 0e 3a f2 4b 42 f0 71 W0...b....:.KB.q 0090 6b a9 f3 36 93 a1 80 17 db 46 3e e0 a1 12 63 6e k..6.....F>...cn 00a0 6a 31 9b f1 86 dd 3f 27 09 0c 52 9b 59 61 7b 89 j1....?'..R.Ya{. 00b0 7e 2b d1 f3 46 65 50 36 0a dd 10 ab 86 55 8a 34 ~+..FeP6.....U.4 00c0 ac 1d 1b 92 41 da 8a 1a 1c c9 06 2f 30 e5 a2 0c ....A....../0... 00d0 c2 97 55 eb 80 a8 ef 47 34 17 90 3e 14 6e 84 f2 ..U....G4..>.n.. 00e0 90 5f 3f f4 c4 77 93 f1 2a ab b9 4b a8 5e b3 85 ._?..w..*..K.^.. 00f0 20 c2 d3 57 96 11 e5 a1 e1 57 3b e2 41 eb c1 e8 ..W.....W;.A... 0100 4d c3 c7 62 1c 6f 6c 6a 02 10 d5 20 54 e5 b3 93 M..b.olj... T... 0110 e2 00 06 bf fb 4c 1c 10 9f c3 5c ed 90 f7 fb 92 .....L....\..... 0120 ee 78 90 54 7c 04 95 22 56 5c 3d e7 61 20 34 f6 .x.T|.."V\=.a 4. 0130 bc 8e 15 07 30 2d 30 c8 3f 88 bb e2 0d 5f f9 77 ....0-0.?...._.w 0140 73 8c b7 35 2f 8e 91 1c 98 e7 1b ab 78 27 bc 97 s..5/.......x'.. 0150 4b 49 2c 09 d7 ed 25 4c 44 c5 92 10 65 3d 4f 2b KI,...%LD...e=O+ 0160 11 34 52 a2 19 64 0b 66 02 14 11 41 43 af 29 d6 .4R..d.f...AC.). 0170 c7 1d 9e e8 57 7e f1 ba 95 c0 75 b1 0a 92 3a 6d ....W~....u...:m 0180 e0 da 37 b7 12 34 3f 2a d9 5f 72 ed 6c be ..7..4?*._r.l. Frame 11 (398 bytes on wire, 398 bytes captured) Arrival Time: Aug 14, 2006 12:38:30.754227000 Time delta from previous packet: 0.004540000 seconds Time since reference or first frame: 8.746059000 seconds Frame Number: 11 Packet Length: 398 bytes Capture Length: 398 bytes Protocols in frame: eth:ip:esp:data Ethernet II, Src: 00:0c:41:90:f1:c1 (00:0c:41:90:f1:c1), Dst: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa) Destination: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa) Source: 00:0c:41:90:f1:c1 (00:0c:41:90:f1:c1) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.133 (165.227.249.133), Dst: 165.227.249.150 (165.227.249.150) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 384 Identification: 0xacc2 (44226) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: ESP (0x32) Header checksum: 0x8da6 [correct] Good: True Bad : False Source: 165.227.249.133 (165.227.249.133) Destination: 165.227.249.150 (165.227.249.150) Encapsulating Security Payload SPI: 0x12153f9e Sequence: 1 Data (356 bytes) 0000 00 0c 29 96 e1 fa 00 0c 41 90 f1 c1 08 00 45 00 ..).....A.....E. 0010 01 80 ac c2 00 00 40 32 8d a6 a5 e3 f9 85 a5 e3 ......@2........ 0020 f9 96 12 15 3f 9e 00 00 00 01 2a 2b 2c 2d 2e 2f ....?.....*+,-./ 0030 30 31 2b be 72 72 27 91 fa ac c0 07 1c ea ad 31 01+.rr'........1 0040 28 81 50 48 61 9b 36 27 45 5d 7c e0 b5 ee 09 fe (.PHa.6'E]|..... 0050 03 43 69 bc ce 8a 90 bc 80 0e 18 e0 1d 31 e5 38 .Ci..........1.8 0060 c1 fa 0a a1 a9 11 01 04 cb 7a 54 e7 f6 43 d1 63 .........zT..C.c 0070 b1 2d c9 31 63 3b d0 f5 79 d6 31 dc 80 7c 02 9a .-.1c;..y.1..|.. 0080 9f 2f 61 bf fd a9 3e d3 96 b4 cf 8c 5c ee 17 90 ./a...>.....\... 0090 ce 13 b8 6e 8c d5 ad 41 fc 15 98 ae 33 63 a8 74 ...n...A....3c.t 00a0 2d a4 46 91 2d a6 24 a8 c5 7b 6f 98 35 02 03 1a -.F.-.$..{o.5... 00b0 61 9b 2e 20 71 d4 94 31 e5 8e 79 4b 92 c2 f5 3b a.. q..1..yK...; 00c0 32 2d 51 78 ca 07 5f 29 e3 84 56 f0 a9 b0 cc 02 2-Qx.._)..V..... 00d0 33 00 1e 41 18 be 5c 8b e8 c9 3d b5 96 a1 1e 69 3..A..\...=....i 00e0 17 b8 b4 fe c8 1f 64 a6 9a ca 73 87 3c ff 26 61 ......d...s.<.&a 00f0 01 19 ce 13 28 68 d1 47 c1 a1 b4 91 eb 23 84 ef ....(h.G.....#.. 0100 79 b6 aa 51 4a a6 a8 a0 d7 e6 ce 13 ea 8a 0e 74 y..QJ..........t 0110 2e ba 2f f7 be d7 eb 47 e7 42 6f d1 4e 93 a4 24 ../....G.Bo.N..$ 0120 16 6c 07 07 fe 74 ee a4 52 9d e9 a1 48 31 0a 1f .l...t..R...H1.. 0130 24 f4 b8 32 c9 c8 56 77 53 cd e0 20 d1 d1 18 04 $..2..VwS.. .... 0140 2c 43 25 01 25 1d e0 28 af 1c 50 be 94 41 ee 22 ,C%.%..(..P..A." 0150 86 cc 62 bb 7e e3 e1 bf ec f8 21 e4 71 5f 2e 13 ..b.~.....!.q_.. 0160 29 d3 c5 b9 73 4d c3 66 25 af 3b e0 78 c8 03 b6 )...sM.f%.;.x... 0170 78 6b b2 82 64 bd 8c a7 27 b1 61 96 bd 4c e5 45 xk..d...'.a..L.E 0180 ee 64 ad 9f 97 4a 78 9b a8 af 62 9e 56 cd .d...Jx...b.V.