Frame 1 (222 bytes on wire, 222 bytes captured) Arrival Time: Aug 13, 2006 13:20:58.103158000 Time delta from previous packet: 0.000000000 seconds Time since reference or first frame: 0.000000000 seconds Frame Number: 1 Packet Length: 222 bytes Capture Length: 222 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa), Dst: 00:0c:29:f3:c0:a0 (00:0c:29:f3:c0:a0) Destination: 00:0c:29:f3:c0:a0 (00:0c:29:f3:c0:a0) Source: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.150 (165.227.249.150), Dst: 165.227.249.134 (165.227.249.134) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 208 Identification: 0x0327 (807) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: UDP (0x11) Header checksum: 0xf811 [correct] Good: True Bad : False Source: 165.227.249.150 (165.227.249.150) Destination: 165.227.249.134 (165.227.249.134) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 188 Checksum: 0x0f6d [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0xCC5E2871396A98E0 Responder cookie: 0x0000000000000000 Next payload: Security Association (1) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 180 Security Association payload Next payload: Vendor ID (13) Length: 52 Domain of interpretation: IPSEC (1) Situation: IDENTITY (1) Proposal payload # 1 Next payload: NONE (0) Length: 40 Proposal number: 1 Protocol ID: ISAKMP (1) SPI size: 0 Number of transforms: 1 Transform payload # 1 Next payload: NONE (0) Length: 32 Transform number: 1 Transform ID: KEY_IKE (1) Encryption-Algorithm (1): 3DES-CBC (5) Hash-Algorithm (2): SHA (2) Group-Description (4): Alternate 1024-bit MODP group (2) Authentication-Method (3): PSK (1) Life-Type (11): Seconds (1) Life-Duration (12): Duration-Value (28800) Vendor ID payload Next payload: Vendor ID (13) Length: 20 Vendor ID: unknown vendor ID: 0x4A131C81070358455C5728F20E95452F Vendor ID payload Next payload: Vendor ID (13) Length: 20 Vendor ID: draft-ietf-ipsec-nat-t-ike-03 Vendor ID payload Next payload: Vendor ID (13) Length: 20 Vendor ID: draft-ietf-ipsec-nat-t-ike-02 Vendor ID payload Next payload: Vendor ID (13) Length: 20 Vendor ID: draft-ietf-ipsec-nat-t-ike-00 Vendor ID payload Next payload: NONE (0) Length: 20 Vendor ID: RFC 3706 Detecting Dead IKE Peers (DPD) 0000 00 0c 29 f3 c0 a0 00 0c 29 96 e1 fa 08 00 45 00 ..).....).....E. 0010 00 d0 03 27 00 00 80 11 f8 11 a5 e3 f9 96 a5 e3 ...'............ 0020 f9 86 01 f4 01 f4 00 bc 0f 6d cc 5e 28 71 39 6a .........m.^(q9j 0030 98 e0 00 00 00 00 00 00 00 00 01 10 02 00 00 00 ................ 0040 00 00 00 00 00 b4 0d 00 00 34 00 00 00 01 00 00 .........4...... 0050 00 01 00 00 00 28 01 01 00 01 00 00 00 20 01 01 .....(....... .. 0060 00 00 80 01 00 05 80 02 00 02 80 04 00 02 80 03 ................ 0070 00 01 80 0b 00 01 80 0c 70 80 0d 00 00 14 4a 13 ........p.....J. 0080 1c 81 07 03 58 45 5c 57 28 f2 0e 95 45 2f 0d 00 ....XE\W(...E/.. 0090 00 14 7d 94 19 a6 53 10 ca 6f 2c 17 9d 92 15 52 ..}...S..o,....R 00a0 9d 56 0d 00 00 14 90 cb 80 91 3e bb 69 6e 08 63 .V........>.in.c 00b0 81 b5 ec 42 7b 1f 0d 00 00 14 44 85 15 2d 18 b6 ...B{.....D..-.. 00c0 bb cd 0b e8 a8 46 95 79 dd cc 00 00 00 14 af ca .....F.y........ 00d0 d7 13 68 a1 f1 c9 6b 86 96 fc 77 57 01 00 ..h...k...wW.. Frame 2 (122 bytes on wire, 122 bytes captured) Arrival Time: Aug 13, 2006 13:20:58.179880000 Time delta from previous packet: 0.076722000 seconds Time since reference or first frame: 0.076722000 seconds Frame Number: 2 Packet Length: 122 bytes Capture Length: 122 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:0c:29:f3:c0:a0 (00:0c:29:f3:c0:a0), Dst: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa) Destination: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa) Source: 00:0c:29:f3:c0:a0 (00:0c:29:f3:c0:a0) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.134 (165.227.249.134), Dst: 165.227.249.150 (165.227.249.150) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 108 Identification: 0x0014 (20) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0x3b89 [correct] Good: True Bad : False Source: 165.227.249.134 (165.227.249.134) Destination: 165.227.249.150 (165.227.249.150) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 88 Checksum: 0x7eb6 [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0xCC5E2871396A98E0 Responder cookie: 0x3F74EA297DE3588E Next payload: Security Association (1) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 80 Security Association payload Next payload: NONE (0) Length: 52 Domain of interpretation: IPSEC (1) Situation: IDENTITY (1) Proposal payload # 1 Next payload: NONE (0) Length: 40 Proposal number: 1 Protocol ID: ISAKMP (1) SPI size: 0 Number of transforms: 1 Transform payload # 1 Next payload: NONE (0) Length: 32 Transform number: 1 Transform ID: KEY_IKE (1) Encryption-Algorithm (1): 3DES-CBC (5) Hash-Algorithm (2): SHA (2) Group-Description (4): Alternate 1024-bit MODP group (2) Authentication-Method (3): PSK (1) Life-Type (11): Seconds (1) Life-Duration (12): Duration-Value (28800) 0000 00 0c 29 96 e1 fa 00 0c 29 f3 c0 a0 08 00 45 00 ..).....).....E. 0010 00 6c 00 14 00 00 40 11 3b 89 a5 e3 f9 86 a5 e3 .l....@.;....... 0020 f9 96 01 f4 01 f4 00 58 7e b6 cc 5e 28 71 39 6a .......X~..^(q9j 0030 98 e0 3f 74 ea 29 7d e3 58 8e 01 10 02 00 00 00 ..?t.)}.X....... 0040 00 00 00 00 00 50 00 00 00 34 00 00 00 01 00 00 .....P...4...... 0050 00 01 00 00 00 28 01 01 00 01 00 00 00 20 01 01 .....(....... .. 0060 00 00 80 01 00 05 80 02 00 02 80 04 00 02 80 03 ................ 0070 00 01 80 0b 00 01 80 0c 70 80 ........p. Frame 3 (222 bytes on wire, 222 bytes captured) Arrival Time: Aug 13, 2006 13:20:58.179882000 Time delta from previous packet: 0.000002000 seconds Time since reference or first frame: 0.076724000 seconds Frame Number: 3 Packet Length: 222 bytes Capture Length: 222 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa), Dst: 00:0c:29:f3:c0:a0 (00:0c:29:f3:c0:a0) Destination: 00:0c:29:f3:c0:a0 (00:0c:29:f3:c0:a0) Source: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.150 (165.227.249.150), Dst: 165.227.249.134 (165.227.249.134) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 208 Identification: 0x0328 (808) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: UDP (0x11) Header checksum: 0xf810 [correct] Good: True Bad : False Source: 165.227.249.150 (165.227.249.150) Destination: 165.227.249.134 (165.227.249.134) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 188 Checksum: 0xc55e [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0xCC5E2871396A98E0 Responder cookie: 0x3F74EA297DE3588E Next payload: Key Exchange (4) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 180 Key Exchange payload Next payload: Nonce (10) Length: 132 Key Exchange Data Nonce payload Next payload: NONE (0) Length: 20 Nonce Data 0000 00 0c 29 f3 c0 a0 00 0c 29 96 e1 fa 08 00 45 00 ..).....).....E. 0010 00 d0 03 28 00 00 80 11 f8 10 a5 e3 f9 96 a5 e3 ...(............ 0020 f9 86 01 f4 01 f4 00 bc c5 5e cc 5e 28 71 39 6a .........^.^(q9j 0030 98 e0 3f 74 ea 29 7d e3 58 8e 04 10 02 00 00 00 ..?t.)}.X....... 0040 00 00 00 00 00 b4 0a 00 00 84 8f dc 2c ec 57 15 ............,.W. 0050 48 40 98 16 ea 27 ff 97 13 df e1 aa 42 af 3b 7b H@...'......B.;{ 0060 7d d5 16 f9 2a 69 28 48 87 82 ad f1 4e 7f 99 42 }...*i(H....N..B 0070 4a 35 53 41 98 2b 08 36 40 1a ac ae ef 0f 2d 44 J5SA.+.6@.....-D 0080 cd 37 fd 70 5a 49 ca 00 df 1e 92 aa 49 ba d0 6b .7.pZI......I..k 0090 e4 78 a4 03 53 f9 2d e5 e7 fd 27 ea 5c 31 5a 0d .x..S.-...'.\1Z. 00a0 42 46 37 e2 ef 20 76 ff fc c9 77 a2 8c cc 5c ef BF7.. v...w...\. 00b0 5b c3 13 8a 99 07 41 eb 71 6a db 99 e3 fc fd a0 [.....A.qj...... 00c0 1f 84 fc b6 f9 67 42 b9 4f 8d 00 00 00 14 b2 7e .....gB.O......~ 00d0 1b 5c 67 40 b8 41 2f 97 9f 45 70 f7 a8 9c .\g@.A/..Ep... Frame 4 (222 bytes on wire, 222 bytes captured) Arrival Time: Aug 13, 2006 13:20:58.228315000 Time delta from previous packet: 0.048433000 seconds Time since reference or first frame: 0.125157000 seconds Frame Number: 4 Packet Length: 222 bytes Capture Length: 222 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:0c:29:f3:c0:a0 (00:0c:29:f3:c0:a0), Dst: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa) Destination: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa) Source: 00:0c:29:f3:c0:a0 (00:0c:29:f3:c0:a0) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.134 (165.227.249.134), Dst: 165.227.249.150 (165.227.249.150) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 208 Identification: 0x0015 (21) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0x3b24 [correct] Good: True Bad : False Source: 165.227.249.134 (165.227.249.134) Destination: 165.227.249.150 (165.227.249.150) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 188 Checksum: 0xeb97 [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0xCC5E2871396A98E0 Responder cookie: 0x3F74EA297DE3588E Next payload: Key Exchange (4) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 180 Key Exchange payload Next payload: Nonce (10) Length: 132 Key Exchange Data Nonce payload Next payload: NONE (0) Length: 20 Nonce Data 0000 00 0c 29 96 e1 fa 00 0c 29 f3 c0 a0 08 00 45 00 ..).....).....E. 0010 00 d0 00 15 00 00 40 11 3b 24 a5 e3 f9 86 a5 e3 ......@.;$...... 0020 f9 96 01 f4 01 f4 00 bc eb 97 cc 5e 28 71 39 6a ...........^(q9j 0030 98 e0 3f 74 ea 29 7d e3 58 8e 04 10 02 00 00 00 ..?t.)}.X....... 0040 00 00 00 00 00 b4 0a 00 00 84 f2 8e a8 67 7e 4c .............g~L 0050 7f 46 68 fc e0 ae a0 62 d7 d2 c7 9e bc 83 13 b9 .Fh....b........ 0060 d1 5b c2 39 37 10 b6 2c c3 b5 18 d3 a0 88 de c7 .[.97..,........ 0070 cc 4b 54 da a7 37 c3 c4 47 ea fd ae ce ca 21 86 .KT..7..G.....!. 0080 0d 8a b1 b1 2c ca 63 97 1b 83 fc f3 55 80 3e 88 ....,.c.....U.>. 0090 5a 99 27 d3 c5 48 4e 39 67 7c 08 df cd 45 2a b6 Z.'..HN9g|...E*. 00a0 92 6a 4a f5 d7 06 e8 b7 ec e0 e7 c1 86 3d 14 5f .jJ..........=._ 00b0 9b 0b 1b 2a 0a 95 5e 19 f4 76 45 72 1d 44 df 3c ...*..^..vEr.D.< 00c0 75 48 b1 eb 16 b0 30 6e d6 23 00 00 00 14 61 4f uH....0n.#....aO 00d0 51 96 f6 72 e6 5f 01 d8 98 79 62 32 39 ca Q..r._...yb29. Frame 5 (142 bytes on wire, 142 bytes captured) Arrival Time: Aug 13, 2006 13:20:58.267849000 Time delta from previous packet: 0.039534000 seconds Time since reference or first frame: 0.164691000 seconds Frame Number: 5 Packet Length: 142 bytes Capture Length: 142 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa), Dst: 00:0c:29:f3:c0:a0 (00:0c:29:f3:c0:a0) Destination: 00:0c:29:f3:c0:a0 (00:0c:29:f3:c0:a0) Source: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.150 (165.227.249.150), Dst: 165.227.249.134 (165.227.249.134) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 128 Identification: 0x0329 (809) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: UDP (0x11) Header checksum: 0xf85f [correct] Good: True Bad : False Source: 165.227.249.150 (165.227.249.150) Destination: 165.227.249.134 (165.227.249.134) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 108 Checksum: 0x7ff1 [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0xCC5E2871396A98E0 Responder cookie: 0x3F74EA297DE3588E Next payload: Identification (5) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 100 Encrypted payload (72 bytes) 0000 00 0c 29 f3 c0 a0 00 0c 29 96 e1 fa 08 00 45 00 ..).....).....E. 0010 00 80 03 29 00 00 80 11 f8 5f a5 e3 f9 96 a5 e3 ...)....._...... 0020 f9 86 01 f4 01 f4 00 6c 7f f1 cc 5e 28 71 39 6a .......l...^(q9j 0030 98 e0 3f 74 ea 29 7d e3 58 8e 05 10 02 01 00 00 ..?t.)}.X....... 0040 00 00 00 00 00 64 bf fc 24 95 7d 61 a4 a7 c3 60 .....d..$.}a...` 0050 2b bb 34 71 fc 35 5c 52 78 8e 70 e9 18 6f 67 89 +.4q.5\Rx.p..og. 0060 2d 99 56 ba 97 71 09 52 9d 4c c7 2d 4f d3 de 2c -.V..q.R.L.-O.., 0070 29 1f 75 05 08 d7 d2 5c 2d 8f 73 ce 06 ee b0 2a ).u....\-.s....* 0080 62 aa 97 99 fb 6b c0 be 3d c3 3e 9f c5 65 b....k..=.>..e Frame 6 (110 bytes on wire, 110 bytes captured) Arrival Time: Aug 13, 2006 13:20:58.271759000 Time delta from previous packet: 0.003910000 seconds Time since reference or first frame: 0.168601000 seconds Frame Number: 6 Packet Length: 110 bytes Capture Length: 110 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:0c:29:f3:c0:a0 (00:0c:29:f3:c0:a0), Dst: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa) Destination: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa) Source: 00:0c:29:f3:c0:a0 (00:0c:29:f3:c0:a0) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.134 (165.227.249.134), Dst: 165.227.249.150 (165.227.249.150) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 96 Identification: 0x0016 (22) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0x3b93 [correct] Good: True Bad : False Source: 165.227.249.134 (165.227.249.134) Destination: 165.227.249.150 (165.227.249.150) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 76 Checksum: 0x7544 [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0xCC5E2871396A98E0 Responder cookie: 0x3F74EA297DE3588E Next payload: Identification (5) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 68 Encrypted payload (40 bytes) 0000 00 0c 29 96 e1 fa 00 0c 29 f3 c0 a0 08 00 45 00 ..).....).....E. 0010 00 60 00 16 00 00 40 11 3b 93 a5 e3 f9 86 a5 e3 .`....@.;....... 0020 f9 96 01 f4 01 f4 00 4c 75 44 cc 5e 28 71 39 6a .......LuD.^(q9j 0030 98 e0 3f 74 ea 29 7d e3 58 8e 05 10 02 01 00 00 ..?t.)}.X....... 0040 00 00 00 00 00 44 c9 50 29 81 19 af 86 66 fb 98 .....D.P)....f.. 0050 e5 3a cb c3 4f 9f 0c f1 bc b5 23 06 01 e5 5a ab .:..O.....#...Z. 0060 b9 41 97 19 0b 5c 18 86 ea 28 2c dd 15 26 .A...\...(,..& Frame 7 (334 bytes on wire, 334 bytes captured) Arrival Time: Aug 13, 2006 13:20:58.307377000 Time delta from previous packet: 0.035618000 seconds Time since reference or first frame: 0.204219000 seconds Frame Number: 7 Packet Length: 334 bytes Capture Length: 334 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa), Dst: 00:0c:29:f3:c0:a0 (00:0c:29:f3:c0:a0) Destination: 00:0c:29:f3:c0:a0 (00:0c:29:f3:c0:a0) Source: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.150 (165.227.249.150), Dst: 165.227.249.134 (165.227.249.134) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 320 Identification: 0x032a (810) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: UDP (0x11) Header checksum: 0xf79e [correct] Good: True Bad : False Source: 165.227.249.150 (165.227.249.150) Destination: 165.227.249.134 (165.227.249.134) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 300 Checksum: 0xda7a [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0xCC5E2871396A98E0 Responder cookie: 0x3F74EA297DE3588E Next payload: Hash (8) Version: 1.0 Exchange type: Quick Mode (32) Flags .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x75E2AFDF Length: 292 Encrypted payload (264 bytes) 0000 00 0c 29 f3 c0 a0 00 0c 29 96 e1 fa 08 00 45 00 ..).....).....E. 0010 01 40 03 2a 00 00 80 11 f7 9e a5 e3 f9 96 a5 e3 .@.*............ 0020 f9 86 01 f4 01 f4 01 2c da 7a cc 5e 28 71 39 6a .......,.z.^(q9j 0030 98 e0 3f 74 ea 29 7d e3 58 8e 08 10 20 01 75 e2 ..?t.)}.X... .u. 0040 af df 00 00 01 24 4b c1 64 d5 f3 a9 42 c1 52 bf .....$K.d...B.R. 0050 63 5f 73 d9 5a d6 52 fd e9 27 23 9e 3c 27 86 24 c_s.Z.R..'#.<'.$ 0060 2c 8e 83 78 9c a6 d0 9c 63 a4 39 33 49 fa 07 fc ,..x....c.93I... 0070 78 b7 f1 5b e1 1b ef 1f 38 dd ba ef 23 3d a3 ed x..[....8...#=.. 0080 04 34 58 2b 1a ae 93 5f e3 7c d6 09 76 b8 7b 62 .4X+..._.|..v.{b 0090 93 b1 e9 2d be 0a 0d 99 77 72 58 36 72 e5 9f a3 ...-....wrX6r... 00a0 21 59 92 11 8a 16 e4 e0 55 5f 60 d6 bb 4f a7 09 !Y......U_`..O.. 00b0 ad 12 37 ab 40 03 d1 7c 42 b3 fa 1a e0 b3 5f 43 ..7.@..|B....._C 00c0 5d 8a e6 da 78 cf c1 0f 4a 83 a1 b9 70 cd 62 d2 ]...x...J...p.b. 00d0 45 e0 2b d9 13 f0 fe 6d 9d 92 e7 a7 07 d6 bc 5b E.+....m.......[ 00e0 d9 6d 22 8a 1c de da 25 19 db be b4 b7 f8 f2 29 .m"....%.......) 00f0 61 90 71 6b 71 a6 66 5c ff d8 36 62 5a e7 86 9b a.qkq.f\..6bZ... 0100 89 62 5c 9e 5b 4b aa 50 98 62 6d f4 79 f2 e9 6a .b\.[K.P.bm.y..j 0110 ed e6 96 16 76 d6 cd 70 b5 9f 80 a1 11 c3 58 a5 ....v..p......X. 0120 53 5a d5 42 00 20 22 95 db 79 af bd 06 d1 07 f3 SZ.B. "..y...... 0130 21 a0 0b bc ea 26 2f 7a 89 e9 10 1e 10 3a 08 dc !....&/z.....:.. 0140 d5 fc 8c a0 0d 25 7c fc 0b b9 a4 07 2d fd .....%|.....-. Frame 8 (326 bytes on wire, 326 bytes captured) Arrival Time: Aug 13, 2006 13:20:58.316006000 Time delta from previous packet: 0.008629000 seconds Time since reference or first frame: 0.212848000 seconds Frame Number: 8 Packet Length: 326 bytes Capture Length: 326 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:0c:29:f3:c0:a0 (00:0c:29:f3:c0:a0), Dst: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa) Destination: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa) Source: 00:0c:29:f3:c0:a0 (00:0c:29:f3:c0:a0) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.134 (165.227.249.134), Dst: 165.227.249.150 (165.227.249.150) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 312 Identification: 0x0017 (23) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0x3aba [correct] Good: True Bad : False Source: 165.227.249.134 (165.227.249.134) Destination: 165.227.249.150 (165.227.249.150) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 292 Checksum: 0xd851 [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0xCC5E2871396A98E0 Responder cookie: 0x3F74EA297DE3588E Next payload: Hash (8) Version: 1.0 Exchange type: Quick Mode (32) Flags .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x75E2AFDF Length: 284 Encrypted payload (256 bytes) 0000 00 0c 29 96 e1 fa 00 0c 29 f3 c0 a0 08 00 45 00 ..).....).....E. 0010 01 38 00 17 00 00 40 11 3a ba a5 e3 f9 86 a5 e3 .8....@.:....... 0020 f9 96 01 f4 01 f4 01 24 d8 51 cc 5e 28 71 39 6a .......$.Q.^(q9j 0030 98 e0 3f 74 ea 29 7d e3 58 8e 08 10 20 01 75 e2 ..?t.)}.X... .u. 0040 af df 00 00 01 1c 6c f6 b2 74 7b e5 65 34 64 e4 ......l..t{.e4d. 0050 8b d3 4a f7 41 83 78 01 db ea 1d 19 b0 6c 0d ae ..J.A.x......l.. 0060 a0 2e 0e 49 25 e5 8b e5 93 a5 0b 51 53 12 d0 1a ...I%......QS... 0070 6d 08 bb 45 05 0b be 45 43 66 d9 6b ce df c0 0d m..E...ECf.k.... 0080 04 75 05 6b df 71 0a f7 1b e5 bb a7 e3 22 ed 78 .u.k.q.......".x 0090 47 05 d9 07 37 2c be 15 4d 3a 60 dd 1f d9 c3 1f G...7,..M:`..... 00a0 13 88 26 76 4b 38 5d 5f f6 cc 33 82 93 15 48 53 ..&vK8]_..3...HS 00b0 2c 93 ff c6 a8 37 a1 7d 5d fe 8f 5f e8 df 70 d2 ,....7.}].._..p. 00c0 23 89 59 fc 2e 24 cb 46 45 4d cb df 92 cb 79 5a #.Y..$.FEM....yZ 00d0 fb 68 ed 46 47 0a 53 90 0a a4 c5 12 09 b7 96 94 .h.FG.S......... 00e0 9f d8 bb 10 d6 24 63 ce 8b f1 cb 5c bc 9d 56 1a .....$c....\..V. 00f0 94 0b ff 02 73 9a 8a 0b cf f7 bf 9c db 70 53 2c ....s........pS, 0100 04 59 66 7e 8c 33 8a be 2c 5e e5 ef e5 63 a8 34 .Yf~.3..,^...c.4 0110 b1 33 39 e8 9c 7d c0 47 73 5b 13 ae 9c 50 67 9e .39..}.Gs[...Pg. 0120 5f b4 d9 27 01 19 75 ca b1 9b 59 33 bd f3 74 6d _..'..u...Y3..tm 0130 13 2f 0c 9d 36 4b d9 c5 c9 01 90 d4 9a 90 95 78 ./..6K.........x 0140 c9 31 04 37 3f 99 .1.7?. Frame 9 (102 bytes on wire, 102 bytes captured) Arrival Time: Aug 13, 2006 13:20:58.412124000 Time delta from previous packet: 0.096118000 seconds Time since reference or first frame: 0.308966000 seconds Frame Number: 9 Packet Length: 102 bytes Capture Length: 102 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa), Dst: 00:0c:29:f3:c0:a0 (00:0c:29:f3:c0:a0) Destination: 00:0c:29:f3:c0:a0 (00:0c:29:f3:c0:a0) Source: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.150 (165.227.249.150), Dst: 165.227.249.134 (165.227.249.134) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 88 Identification: 0x032b (811) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: UDP (0x11) Header checksum: 0xf885 [correct] Good: True Bad : False Source: 165.227.249.150 (165.227.249.150) Destination: 165.227.249.134 (165.227.249.134) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 68 Checksum: 0x70fa [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0xCC5E2871396A98E0 Responder cookie: 0x3F74EA297DE3588E Next payload: Hash (8) Version: 1.0 Exchange type: Quick Mode (32) Flags .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x75E2AFDF Length: 60 Encrypted payload (32 bytes) 0000 00 0c 29 f3 c0 a0 00 0c 29 96 e1 fa 08 00 45 00 ..).....).....E. 0010 00 58 03 2b 00 00 80 11 f8 85 a5 e3 f9 96 a5 e3 .X.+............ 0020 f9 86 01 f4 01 f4 00 44 70 fa cc 5e 28 71 39 6a .......Dp..^(q9j 0030 98 e0 3f 74 ea 29 7d e3 58 8e 08 10 20 01 75 e2 ..?t.)}.X... .u. 0040 af df 00 00 00 3c 32 22 0f 58 de 28 80 a5 32 dd .....<2".X.(..2. 0050 8c 8e 15 e3 17 a8 44 b8 ad 3d 59 d7 f7 aa 73 31 ......D..=Y...s1 0060 92 e6 03 32 5c 63 ...2\c Frame 10 (398 bytes on wire, 398 bytes captured) Arrival Time: Aug 13, 2006 13:21:04.381513000 Time delta from previous packet: 5.969389000 seconds Time since reference or first frame: 6.278355000 seconds Frame Number: 10 Packet Length: 398 bytes Capture Length: 398 bytes Protocols in frame: eth:ip:esp:data Ethernet II, Src: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa), Dst: 00:0c:29:f3:c0:a0 (00:0c:29:f3:c0:a0) Destination: 00:0c:29:f3:c0:a0 (00:0c:29:f3:c0:a0) Source: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.150 (165.227.249.150), Dst: 165.227.249.134 (165.227.249.134) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 384 Identification: 0x032c (812) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: ESP (0x32) Header checksum: 0xf73b [correct] Good: True Bad : False Source: 165.227.249.150 (165.227.249.150) Destination: 165.227.249.134 (165.227.249.134) Encapsulating Security Payload SPI: 0x00004099 Sequence: 1 Data (356 bytes) 0000 00 0c 29 f3 c0 a0 00 0c 29 96 e1 fa 08 00 45 00 ..).....).....E. 0010 01 80 03 2c 00 00 80 32 f7 3b a5 e3 f9 96 a5 e3 ...,...2.;...... 0020 f9 86 00 00 40 99 00 00 00 01 93 a9 34 2e 49 dd ....@.......4.I. 0030 67 23 02 71 2b 36 b0 56 15 a5 ba a5 30 e6 03 6f g#.q+6.V....0..o 0040 5b c9 b4 d5 0e c3 5f 77 6e ca e7 8e 93 d5 8c 8d [....._wn....... 0050 fc c5 50 36 09 ff e4 b2 00 46 cb 92 94 fa 79 60 ..P6.....F....y` 0060 4b dc 2e 4c 1f a1 8c 89 48 e8 5f 81 5d 6e 4c 48 K..L....H._.]nLH 0070 4d ab 36 f1 54 c6 3e 65 cf 92 a8 89 60 48 42 84 M.6.T.>e....`HB. 0080 fa c7 3f 70 33 6c a7 84 f8 fc fc f7 13 17 5d 6e ..?p3l........]n 0090 c7 7c 93 1e 04 0f 3b 1b 27 b6 e7 13 80 3f 60 7a .|....;.'....?`z 00a0 ff d8 ab 33 cd a9 40 56 66 8d fe e4 2d 17 5a 3c ...3..@Vf...-.Z< 00b0 4b 43 4a 18 30 f8 b8 09 6d 5b 56 39 ee 12 6d fa KCJ.0...m[V9..m. 00c0 64 45 6b 52 db 8a 9a bf 87 5f b5 8f c4 8f d3 44 dEkR....._.....D 00d0 f9 fd 4e ef d2 71 87 f1 a0 bd e0 28 25 68 20 ca ..N..q.....(%h . 00e0 a3 29 83 dd e0 6d f2 53 81 ac 4f 68 b2 80 df 43 .)...m.S..Oh...C 00f0 a5 23 9f 2c 68 e1 c9 03 02 f0 72 eb 56 e9 a1 7d .#.,h.....r.V..} 0100 93 f9 91 14 f6 a5 ed 51 1e e1 25 49 2d bf 70 39 .......Q..%I-.p9 0110 1b 68 2d 3a 94 9b e8 49 f9 5c 24 75 ef 9e 13 c7 .h-:...I.\$u.... 0120 96 ec d5 60 db 11 00 c4 fa db 0e 5c 07 eb f2 e8 ...`.......\.... 0130 ea 84 0d d0 76 cc 7e bd 51 2c a8 f6 18 a8 9c b2 ....v.~.Q,...... 0140 c8 2a 9b 30 96 61 f6 87 80 68 3c 2f 85 49 5e d8 .*.0.a...h