Frame 1 (222 bytes on wire, 222 bytes captured) Arrival Time: Aug 14, 2006 12:52:24.035518000 Time delta from previous packet: 0.000000000 seconds Time since reference or first frame: 0.000000000 seconds Frame Number: 1 Packet Length: 222 bytes Capture Length: 222 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa), Dst: 00:0f:b5:c4:e4:ae (00:0f:b5:c4:e4:ae) Destination: 00:0f:b5:c4:e4:ae (00:0f:b5:c4:e4:ae) Source: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.150 (165.227.249.150), Dst: 165.227.249.137 (165.227.249.137) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 208 Identification: 0x0201 (513) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: UDP (0x11) Header checksum: 0xf934 [correct] Good: True Bad : False Source: 165.227.249.150 (165.227.249.150) Destination: 165.227.249.137 (165.227.249.137) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 188 Checksum: 0xc976 [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0x70E6C2B871B167BD Responder cookie: 0x0000000000000000 Next payload: Security Association (1) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 180 Security Association payload Next payload: Vendor ID (13) Length: 52 Domain of interpretation: IPSEC (1) Situation: IDENTITY (1) Proposal payload # 1 Next payload: NONE (0) Length: 40 Proposal number: 1 Protocol ID: ISAKMP (1) SPI size: 0 Number of transforms: 1 Transform payload # 1 Next payload: NONE (0) Length: 32 Transform number: 1 Transform ID: KEY_IKE (1) Encryption-Algorithm (1): 3DES-CBC (5) Hash-Algorithm (2): SHA (2) Group-Description (4): Alternate 1024-bit MODP group (2) Authentication-Method (3): PSK (1) Life-Type (11): Seconds (1) Life-Duration (12): Duration-Value (28800) Vendor ID payload Next payload: Vendor ID (13) Length: 20 Vendor ID: unknown vendor ID: 0x4A131C81070358455C5728F20E95452F Vendor ID payload Next payload: Vendor ID (13) Length: 20 Vendor ID: draft-ietf-ipsec-nat-t-ike-03 Vendor ID payload Next payload: Vendor ID (13) Length: 20 Vendor ID: draft-ietf-ipsec-nat-t-ike-02 Vendor ID payload Next payload: Vendor ID (13) Length: 20 Vendor ID: draft-ietf-ipsec-nat-t-ike-00 Vendor ID payload Next payload: NONE (0) Length: 20 Vendor ID: RFC 3706 Detecting Dead IKE Peers (DPD) 0000 00 0f b5 c4 e4 ae 00 0c 29 96 e1 fa 08 00 45 00 ........).....E. 0010 00 d0 02 01 00 00 80 11 f9 34 a5 e3 f9 96 a5 e3 .........4...... 0020 f9 89 01 f4 01 f4 00 bc c9 76 70 e6 c2 b8 71 b1 .........vp...q. 0030 67 bd 00 00 00 00 00 00 00 00 01 10 02 00 00 00 g............... 0040 00 00 00 00 00 b4 0d 00 00 34 00 00 00 01 00 00 .........4...... 0050 00 01 00 00 00 28 01 01 00 01 00 00 00 20 01 01 .....(....... .. 0060 00 00 80 01 00 05 80 02 00 02 80 04 00 02 80 03 ................ 0070 00 01 80 0b 00 01 80 0c 70 80 0d 00 00 14 4a 13 ........p.....J. 0080 1c 81 07 03 58 45 5c 57 28 f2 0e 95 45 2f 0d 00 ....XE\W(...E/.. 0090 00 14 7d 94 19 a6 53 10 ca 6f 2c 17 9d 92 15 52 ..}...S..o,....R 00a0 9d 56 0d 00 00 14 90 cb 80 91 3e bb 69 6e 08 63 .V........>.in.c 00b0 81 b5 ec 42 7b 1f 0d 00 00 14 44 85 15 2d 18 b6 ...B{.....D..-.. 00c0 bb cd 0b e8 a8 46 95 79 dd cc 00 00 00 14 af ca .....F.y........ 00d0 d7 13 68 a1 f1 c9 6b 86 96 fc 77 57 01 00 ..h...k...wW.. Frame 2 (182 bytes on wire, 182 bytes captured) Arrival Time: Aug 14, 2006 12:52:24.044364000 Time delta from previous packet: 0.008846000 seconds Time since reference or first frame: 0.008846000 seconds Frame Number: 2 Packet Length: 182 bytes Capture Length: 182 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:0f:b5:c4:e4:ae (00:0f:b5:c4:e4:ae), Dst: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa) Destination: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa) Source: 00:0f:b5:c4:e4:ae (00:0f:b5:c4:e4:ae) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.137 (165.227.249.137), Dst: 165.227.249.150 (165.227.249.150) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 168 Identification: 0x017d (381) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0x39e1 [correct] Good: True Bad : False Source: 165.227.249.137 (165.227.249.137) Destination: 165.227.249.150 (165.227.249.150) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 148 Checksum: 0x0ca4 [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0x70E6C2B871B167BD Responder cookie: 0xDC6198EDDCFA1A62 Next payload: Security Association (1) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 140 Security Association payload Next payload: Vendor ID (13) Length: 52 Domain of interpretation: IPSEC (1) Situation: IDENTITY (1) Proposal payload # 1 Next payload: NONE (0) Length: 40 Proposal number: 1 Protocol ID: ISAKMP (1) SPI size: 0 Number of transforms: 1 Transform payload # 1 Next payload: NONE (0) Length: 32 Transform number: 1 Transform ID: KEY_IKE (1) Encryption-Algorithm (1): 3DES-CBC (5) Hash-Algorithm (2): SHA (2) Group-Description (4): Alternate 1024-bit MODP group (2) Authentication-Method (3): PSK (1) Life-Type (11): Seconds (1) Life-Duration (12): Duration-Value (28800) Vendor ID payload Next payload: Vendor ID (13) Length: 20 Vendor ID: draft-ietf-ipsec-nat-t-ike-02 Vendor ID payload Next payload: Vendor ID (13) Length: 20 Vendor ID: RFC 3706 Detecting Dead IKE Peers (DPD) Vendor ID payload Next payload: NONE (0) Length: 20 Vendor ID: unknown vendor ID: 0x648982785BEDBDD66A6DD356F0E160FD 0000 00 0c 29 96 e1 fa 00 0f b5 c4 e4 ae 08 00 45 00 ..)...........E. 0010 00 a8 01 7d 00 00 40 11 39 e1 a5 e3 f9 89 a5 e3 ...}..@.9....... 0020 f9 96 01 f4 01 f4 00 94 0c a4 70 e6 c2 b8 71 b1 ..........p...q. 0030 67 bd dc 61 98 ed dc fa 1a 62 01 10 02 00 00 00 g..a.....b...... 0040 00 00 00 00 00 8c 0d 00 00 34 00 00 00 01 00 00 .........4...... 0050 00 01 00 00 00 28 01 01 00 01 00 00 00 20 01 01 .....(....... .. 0060 00 00 80 01 00 05 80 02 00 02 80 04 00 02 80 03 ................ 0070 00 01 80 0b 00 01 80 0c 70 80 0d 00 00 14 90 cb ........p....... 0080 80 91 3e bb 69 6e 08 63 81 b5 ec 42 7b 1f 0d 00 ..>.in.c...B{... 0090 00 14 af ca d7 13 68 a1 f1 c9 6b 86 96 fc 77 57 ......h...k...wW 00a0 01 00 00 00 00 14 64 89 82 78 5b ed bd d6 6a 6d ......d..x[...jm 00b0 d3 56 f0 e1 60 fd .V..`. Frame 3 (270 bytes on wire, 270 bytes captured) Arrival Time: Aug 14, 2006 12:52:24.066088000 Time delta from previous packet: 0.021724000 seconds Time since reference or first frame: 0.030570000 seconds Frame Number: 3 Packet Length: 270 bytes Capture Length: 270 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa), Dst: 00:0f:b5:c4:e4:ae (00:0f:b5:c4:e4:ae) Destination: 00:0f:b5:c4:e4:ae (00:0f:b5:c4:e4:ae) Source: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.150 (165.227.249.150), Dst: 165.227.249.137 (165.227.249.137) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 256 Identification: 0x0202 (514) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: UDP (0x11) Header checksum: 0xf903 [correct] Good: True Bad : False Source: 165.227.249.150 (165.227.249.150) Destination: 165.227.249.137 (165.227.249.137) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 236 Checksum: 0x8059 [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0x70E6C2B871B167BD Responder cookie: 0xDC6198EDDCFA1A62 Next payload: Key Exchange (4) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 228 Key Exchange payload Next payload: Nonce (10) Length: 132 Key Exchange Data Nonce payload Next payload: NAT-D (draft-ietf-ipsec-nat-t-ike-01 to 03) (130) Length: 20 Nonce Data NAT-D (draft-ietf-ipsec-nat-t-ike-01 to 03) payload Next payload: NAT-D (draft-ietf-ipsec-nat-t-ike-01 to 03) (130) Length: 24 Hash of address and port: F5FA94E5DDBAD4E79A415F2EABD779A691083B3F NAT-D (draft-ietf-ipsec-nat-t-ike-01 to 03) payload Next payload: NONE (0) Length: 24 Hash of address and port: 579AEB2779FEFC8B9BE0910D966351920D681466 0000 00 0f b5 c4 e4 ae 00 0c 29 96 e1 fa 08 00 45 00 ........).....E. 0010 01 00 02 02 00 00 80 11 f9 03 a5 e3 f9 96 a5 e3 ................ 0020 f9 89 01 f4 01 f4 00 ec 80 59 70 e6 c2 b8 71 b1 .........Yp...q. 0030 67 bd dc 61 98 ed dc fa 1a 62 04 10 02 00 00 00 g..a.....b...... 0040 00 00 00 00 00 e4 0a 00 00 84 26 45 48 f4 7e 03 ..........&EH.~. 0050 06 f8 3b 21 96 de fd 93 5a ea bc 7c 52 ff 56 64 ..;!....Z..|R.Vd 0060 1c 34 58 6f 54 00 22 fd 7e 71 ed 13 3e a5 4a 99 .4XoT.".~q..>.J. 0070 2f f1 a7 02 b3 c1 79 02 4e a4 f9 8b cb a5 d2 39 /.....y.N......9 0080 2e 3d 40 e9 eb 10 39 94 ec c0 b0 d2 c1 bf 52 05 .=@...9.......R. 0090 e1 f1 c6 e1 a3 23 85 0a 72 32 35 fe df a7 b2 2d .....#..r25....- 00a0 af f3 3b ab 98 38 bb 84 36 b3 b3 aa d2 b1 04 1a ..;..8..6....... 00b0 c1 bf 93 d3 ea 50 94 83 27 f5 e8 2c 15 24 91 82 .....P..'..,.$.. 00c0 d3 84 44 e5 86 8a e9 55 2d 59 82 00 00 14 b7 30 ..D....U-Y.....0 00d0 dd 18 f6 19 d6 ca 9a 58 04 7d d6 e3 db 8e 82 00 .......X.}...... 00e0 00 18 f5 fa 94 e5 dd ba d4 e7 9a 41 5f 2e ab d7 ...........A_... 00f0 79 a6 91 08 3b 3f 00 00 00 18 57 9a eb 27 79 fe y...;?....W..'y. 0100 fc 8b 9b e0 91 0d 96 63 51 92 0d 68 14 66 .......cQ..h.f Frame 4 (262 bytes on wire, 262 bytes captured) Arrival Time: Aug 14, 2006 12:52:25.535491000 Time delta from previous packet: 1.469403000 seconds Time since reference or first frame: 1.499973000 seconds Frame Number: 4 Packet Length: 262 bytes Capture Length: 262 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:0f:b5:c4:e4:ae (00:0f:b5:c4:e4:ae), Dst: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa) Destination: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa) Source: 00:0f:b5:c4:e4:ae (00:0f:b5:c4:e4:ae) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.137 (165.227.249.137), Dst: 165.227.249.150 (165.227.249.150) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 248 Identification: 0x017e (382) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0x3990 [correct] Good: True Bad : False Source: 165.227.249.137 (165.227.249.137) Destination: 165.227.249.150 (165.227.249.150) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 228 Checksum: 0x8640 [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0x70E6C2B871B167BD Responder cookie: 0xDC6198EDDCFA1A62 Next payload: Key Exchange (4) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 220 Key Exchange payload Next payload: Nonce (10) Length: 132 Key Exchange Data Nonce payload Next payload: NAT-D (draft-ietf-ipsec-nat-t-ike-01 to 03) (130) Length: 12 Nonce Data NAT-D (draft-ietf-ipsec-nat-t-ike-01 to 03) payload Next payload: NAT-D (draft-ietf-ipsec-nat-t-ike-01 to 03) (130) Length: 24 Hash of address and port: 579AEB2779FEFC8B9BE0910D966351920D681466 NAT-D (draft-ietf-ipsec-nat-t-ike-01 to 03) payload Next payload: NONE (0) Length: 24 Hash of address and port: F5FA94E5DDBAD4E79A415F2EABD779A691083B3F 0000 00 0c 29 96 e1 fa 00 0f b5 c4 e4 ae 08 00 45 00 ..)...........E. 0010 00 f8 01 7e 00 00 40 11 39 90 a5 e3 f9 89 a5 e3 ...~..@.9....... 0020 f9 96 01 f4 01 f4 00 e4 86 40 70 e6 c2 b8 71 b1 .........@p...q. 0030 67 bd dc 61 98 ed dc fa 1a 62 04 10 02 00 00 00 g..a.....b...... 0040 00 00 00 00 00 dc 0a 00 00 84 b4 b1 73 c1 c3 1c ............s... 0050 bf 78 b4 d4 5f 95 5d cf 18 ea ec f5 ae 95 8b 97 .x.._.]......... 0060 46 5e a5 9b c9 1b 99 8b fd 14 d2 4d 10 0e df 6a F^.........M...j 0070 27 b8 da 52 7a e5 6e de ae 9d a1 a1 6c e9 39 68 '..Rz.n.....l.9h 0080 d2 fc f7 59 4d a6 94 de 8a 77 95 41 40 fe 13 96 ...YM....w.A@... 0090 ac 76 19 2a 4a 36 b5 50 58 b5 33 77 b5 54 b9 d3 .v.*J6.PX.3w.T.. 00a0 94 af 40 0f bd ae ff 07 b2 ab 8f 0c 5f 08 08 b5 ..@........._... 00b0 e5 2e 00 02 2a 7d 29 39 56 05 8a 4c 8e 71 64 ce ....*})9V..L.qd. 00c0 c0 50 75 36 db ba e6 24 5b 95 82 00 00 0c ee f6 .Pu6...$[....... 00d0 e1 54 76 78 7c ff 82 00 00 18 57 9a eb 27 79 fe .Tvx|.....W..'y. 00e0 fc 8b 9b e0 91 0d 96 63 51 92 0d 68 14 66 00 00 .......cQ..h.f.. 00f0 00 18 f5 fa 94 e5 dd ba d4 e7 9a 41 5f 2e ab d7 ...........A_... 0100 79 a6 91 08 3b 3f y...;? Frame 5 (142 bytes on wire, 142 bytes captured) Arrival Time: Aug 14, 2006 12:52:25.572671000 Time delta from previous packet: 0.037180000 seconds Time since reference or first frame: 1.537153000 seconds Frame Number: 5 Packet Length: 142 bytes Capture Length: 142 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa), Dst: 00:0f:b5:c4:e4:ae (00:0f:b5:c4:e4:ae) Destination: 00:0f:b5:c4:e4:ae (00:0f:b5:c4:e4:ae) Source: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.150 (165.227.249.150), Dst: 165.227.249.137 (165.227.249.137) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 128 Identification: 0x0203 (515) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: UDP (0x11) Header checksum: 0xf982 [correct] Good: True Bad : False Source: 165.227.249.150 (165.227.249.150) Destination: 165.227.249.137 (165.227.249.137) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 108 Checksum: 0x9944 [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0x70E6C2B871B167BD Responder cookie: 0xDC6198EDDCFA1A62 Next payload: Identification (5) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 100 Encrypted payload (72 bytes) 0000 00 0f b5 c4 e4 ae 00 0c 29 96 e1 fa 08 00 45 00 ........).....E. 0010 00 80 02 03 00 00 80 11 f9 82 a5 e3 f9 96 a5 e3 ................ 0020 f9 89 01 f4 01 f4 00 6c 99 44 70 e6 c2 b8 71 b1 .......l.Dp...q. 0030 67 bd dc 61 98 ed dc fa 1a 62 05 10 02 01 00 00 g..a.....b...... 0040 00 00 00 00 00 64 e3 e7 1f 2c c9 04 98 93 50 2d .....d...,....P- 0050 34 80 57 d9 bc 06 f5 0a 31 16 f4 84 00 99 f7 2c 4.W.....1......, 0060 04 7c bd 0c ca 57 ff 86 b2 86 ec a3 8e e0 00 bf .|...W.......... 0070 71 0e f1 ee 95 16 81 1c f8 28 2c 97 76 3d d5 d7 q........(,.v=.. 0080 0b ff 1c 00 a5 9a 8d c0 26 49 39 33 33 1e ........&I933. Frame 6 (134 bytes on wire, 134 bytes captured) Arrival Time: Aug 14, 2006 12:52:27.254876000 Time delta from previous packet: 1.682205000 seconds Time since reference or first frame: 3.219358000 seconds Frame Number: 6 Packet Length: 134 bytes Capture Length: 134 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:0f:b5:c4:e4:ae (00:0f:b5:c4:e4:ae), Dst: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa) Destination: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa) Source: 00:0f:b5:c4:e4:ae (00:0f:b5:c4:e4:ae) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.137 (165.227.249.137), Dst: 165.227.249.150 (165.227.249.150) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 120 Identification: 0x017f (383) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0x3a0f [correct] Good: True Bad : False Source: 165.227.249.137 (165.227.249.137) Destination: 165.227.249.150 (165.227.249.150) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 100 Checksum: 0x9b58 [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0x70E6C2B871B167BD Responder cookie: 0xDC6198EDDCFA1A62 Next payload: Identification (5) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 92 Encrypted payload (64 bytes) 0000 00 0c 29 96 e1 fa 00 0f b5 c4 e4 ae 08 00 45 00 ..)...........E. 0010 00 78 01 7f 00 00 40 11 3a 0f a5 e3 f9 89 a5 e3 .x....@.:....... 0020 f9 96 01 f4 01 f4 00 64 9b 58 70 e6 c2 b8 71 b1 .......d.Xp...q. 0030 67 bd dc 61 98 ed dc fa 1a 62 05 10 02 01 00 00 g..a.....b...... 0040 00 00 00 00 00 5c 78 2d 3a 1c 08 a5 16 75 37 ae .....\x-:....u7. 0050 d3 84 95 3e 79 db 5a f2 e2 d0 e4 93 fc 1d 06 86 ...>y.Z......... 0060 56 07 90 67 d3 1a ea a2 73 3b 36 34 09 97 fa ce V..g....s;64.... 0070 06 36 85 82 1a 79 9d 7c 25 d4 a9 98 bd a7 2a c0 .6...y.|%.....*. 0080 2f 0d 76 0d 9c 8a /.v... Frame 7 (334 bytes on wire, 334 bytes captured) Arrival Time: Aug 14, 2006 12:52:27.254878000 Time delta from previous packet: 0.000002000 seconds Time since reference or first frame: 3.219360000 seconds Frame Number: 7 Packet Length: 334 bytes Capture Length: 334 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa), Dst: 00:0f:b5:c4:e4:ae (00:0f:b5:c4:e4:ae) Destination: 00:0f:b5:c4:e4:ae (00:0f:b5:c4:e4:ae) Source: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.150 (165.227.249.150), Dst: 165.227.249.137 (165.227.249.137) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 320 Identification: 0x0204 (516) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: UDP (0x11) Header checksum: 0xf8c1 [correct] Good: True Bad : False Source: 165.227.249.150 (165.227.249.150) Destination: 165.227.249.137 (165.227.249.137) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 300 Checksum: 0x9a17 [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0x70E6C2B871B167BD Responder cookie: 0xDC6198EDDCFA1A62 Next payload: Hash (8) Version: 1.0 Exchange type: Quick Mode (32) Flags .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x9CFC50B0 Length: 292 Encrypted payload (264 bytes) 0000 00 0f b5 c4 e4 ae 00 0c 29 96 e1 fa 08 00 45 00 ........).....E. 0010 01 40 02 04 00 00 80 11 f8 c1 a5 e3 f9 96 a5 e3 .@.............. 0020 f9 89 01 f4 01 f4 01 2c 9a 17 70 e6 c2 b8 71 b1 .......,..p...q. 0030 67 bd dc 61 98 ed dc fa 1a 62 08 10 20 01 9c fc g..a.....b.. ... 0040 50 b0 00 00 01 24 9c 83 30 f8 d7 b9 df 07 02 c3 P....$..0....... 0050 9e d5 09 d8 82 b7 80 71 ea dc bf 33 42 67 71 41 .......q...3BgqA 0060 27 6e ea a1 4e fe b0 13 2e 37 d1 1a 15 f4 19 1c 'n..N....7...... 0070 5f 4e 31 92 96 7d 16 21 25 55 78 01 44 9f a0 57 _N1..}.!%Ux.D..W 0080 d9 3e 3b f3 46 5a 9c 6c cf bb e4 9a 1e 02 99 40 .>;.FZ.l.......@ 0090 16 a6 c5 cd b7 bc f0 84 3a 2a 3f d3 c8 f8 4d 88 ........:*?...M. 00a0 0c 8f aa 74 aa 8d d7 82 89 b5 ae f4 33 cf eb 9a ...t........3... 00b0 9b 2f e5 ee 1c b0 e5 4c 83 48 51 4f 26 63 d3 7a ./.....L.HQO&c.z 00c0 f4 37 3e e2 e7 bf 2c 9f 38 ac 6f c3 b7 eb ac 8f .7>...,.8.o..... 00d0 1c 59 0f 63 fe 9b 48 88 7b ee 07 5b 9f fe b1 87 .Y.c..H.{..[.... 00e0 62 3b 9b 7e cd ee 6a a2 7e 82 20 87 b1 ba cf e4 b;.~..j.~. ..... 00f0 40 71 e5 44 aa 92 3e cc ac cc 46 9d a1 c5 1b 76 @q.D..>...F....v 0100 9b ab 6c 22 bc 71 df 94 e2 fe 75 5f bf 41 d2 3f ..l".q....u_.A.? 0110 c0 99 03 31 fe 35 b7 37 e3 26 1b 43 72 45 cb 75 ...1.5.7.&.CrE.u 0120 cf 7b f5 bc a8 92 d6 8f 5f 69 4d 52 0d c6 d7 76 .{......_iMR...v 0130 aa 50 35 bd 71 f9 db fa 0d 8b fc cd 03 bd 60 cb .P5.q.........`. 0140 f3 86 35 1d 98 7e 37 b7 91 7e 31 4b 7f ff ..5..~7..~1K.. Frame 8 (318 bytes on wire, 318 bytes captured) Arrival Time: Aug 14, 2006 12:52:28.697529000 Time delta from previous packet: 1.442651000 seconds Time since reference or first frame: 4.662011000 seconds Frame Number: 8 Packet Length: 318 bytes Capture Length: 318 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:0f:b5:c4:e4:ae (00:0f:b5:c4:e4:ae), Dst: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa) Destination: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa) Source: 00:0f:b5:c4:e4:ae (00:0f:b5:c4:e4:ae) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.137 (165.227.249.137), Dst: 165.227.249.150 (165.227.249.150) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 304 Identification: 0x0184 (388) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0x3952 [correct] Good: True Bad : False Source: 165.227.249.137 (165.227.249.137) Destination: 165.227.249.150 (165.227.249.150) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 284 Checksum: 0xbd2b [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0x70E6C2B871B167BD Responder cookie: 0xDC6198EDDCFA1A62 Next payload: Hash (8) Version: 1.0 Exchange type: Quick Mode (32) Flags .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x9CFC50B0 Length: 276 Encrypted payload (248 bytes) 0000 00 0c 29 96 e1 fa 00 0f b5 c4 e4 ae 08 00 45 00 ..)...........E. 0010 01 30 01 84 00 00 40 11 39 52 a5 e3 f9 89 a5 e3 .0....@.9R...... 0020 f9 96 01 f4 01 f4 01 1c bd 2b 70 e6 c2 b8 71 b1 .........+p...q. 0030 67 bd dc 61 98 ed dc fa 1a 62 08 10 20 01 9c fc g..a.....b.. ... 0040 50 b0 00 00 01 14 ac 71 1c 77 b4 29 1f f9 9e ed P......q.w.).... 0050 17 61 82 c0 48 01 1d 66 fe 25 8f 86 a0 f8 e9 68 .a..H..f.%.....h 0060 5c 0f 11 50 5d 82 ca 1e 41 d6 f2 76 5a 23 7a ff \..P]...A..vZ#z. 0070 a2 e8 f2 62 71 c8 35 3e 3c f0 7d de c0 64 d0 e9 ...bq.5><.}..d.. 0080 8f 62 1c ab c4 f8 4d 8c 5f 92 19 74 fd 00 60 7d .b....M._..t..`} 0090 42 90 d0 38 61 c6 c9 95 4a a4 d1 55 6d 0f bc df B..8a...J..Um... 00a0 72 65 9b fd 5a bd 6f 57 04 d1 83 75 cc ba 3a b8 re..Z.oW...u..:. 00b0 8c a9 a8 2b d9 4f 5d 48 25 6b 5c ad c8 85 f5 c1 ...+.O]H%k\..... 00c0 48 50 7c 7b 6c 49 94 df 20 d6 41 fc e7 ed 98 64 HP|{lI.. .A....d 00d0 a6 6f fb 47 5a 8e d5 1b 48 17 9f 96 16 d1 76 2c .o.GZ...H.....v, 00e0 9c 0b 3c d0 ef 9f 34 c2 cc 0f d5 5e dc c9 65 87 ..<...4....^..e. 00f0 02 b5 f0 6a 3d 46 0b d3 81 df 2a 59 16 b1 49 af ...j=F....*Y..I. 0100 d3 8f 65 78 8a 68 5b a8 ba 38 00 14 08 b3 b2 9e ..ex.h[..8...... 0110 a3 fd d7 a0 80 71 35 72 da c5 95 81 79 78 91 15 .....q5r....yx.. 0120 5b e4 cc 97 16 87 dc b4 5a 1d 00 20 ba 2a e7 b3 [.......Z.. .*.. 0130 d6 e6 32 fd 7b 22 d1 56 06 f5 e2 7b 13 f0 ..2.{".V...{.. Frame 9 (102 bytes on wire, 102 bytes captured) Arrival Time: Aug 14, 2006 12:52:28.754888000 Time delta from previous packet: 0.057359000 seconds Time since reference or first frame: 4.719370000 seconds Frame Number: 9 Packet Length: 102 bytes Capture Length: 102 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa), Dst: 00:0f:b5:c4:e4:ae (00:0f:b5:c4:e4:ae) Destination: 00:0f:b5:c4:e4:ae (00:0f:b5:c4:e4:ae) Source: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.150 (165.227.249.150), Dst: 165.227.249.137 (165.227.249.137) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 88 Identification: 0x0205 (517) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: UDP (0x11) Header checksum: 0xf9a8 [correct] Good: True Bad : False Source: 165.227.249.150 (165.227.249.150) Destination: 165.227.249.137 (165.227.249.137) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 68 Checksum: 0xc6f0 [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0x70E6C2B871B167BD Responder cookie: 0xDC6198EDDCFA1A62 Next payload: Hash (8) Version: 1.0 Exchange type: Quick Mode (32) Flags .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x9CFC50B0 Length: 60 Encrypted payload (32 bytes) 0000 00 0f b5 c4 e4 ae 00 0c 29 96 e1 fa 08 00 45 00 ........).....E. 0010 00 58 02 05 00 00 80 11 f9 a8 a5 e3 f9 96 a5 e3 .X.............. 0020 f9 89 01 f4 01 f4 00 44 c6 f0 70 e6 c2 b8 71 b1 .......D..p...q. 0030 67 bd dc 61 98 ed dc fa 1a 62 08 10 20 01 9c fc g..a.....b.. ... 0040 50 b0 00 00 00 3c 40 9f 1c 69 ab 76 d0 9f 68 89 P....<@..i.v..h. 0050 1b 67 6a 8a c5 72 03 93 55 e2 8e 3b 6f ea f0 a5 .gj..r..U..;o... 0060 ab bb 30 d7 b4 10 ..0... Frame 10 (398 bytes on wire, 398 bytes captured) Arrival Time: Aug 14, 2006 12:52:34.645241000 Time delta from previous packet: 5.890353000 seconds Time since reference or first frame: 10.609723000 seconds Frame Number: 10 Packet Length: 398 bytes Capture Length: 398 bytes Protocols in frame: eth:ip:esp:data Ethernet II, Src: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa), Dst: 00:0f:b5:c4:e4:ae (00:0f:b5:c4:e4:ae) Destination: 00:0f:b5:c4:e4:ae (00:0f:b5:c4:e4:ae) Source: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.150 (165.227.249.150), Dst: 165.227.249.137 (165.227.249.137) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 384 Identification: 0x0207 (519) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: ESP (0x32) Header checksum: 0xf85d [correct] Good: True Bad : False Source: 165.227.249.150 (165.227.249.150) Destination: 165.227.249.137 (165.227.249.137) Encapsulating Security Payload SPI: 0xb45395a5 Sequence: 1 Data (356 bytes) 0000 00 0f b5 c4 e4 ae 00 0c 29 96 e1 fa 08 00 45 00 ........).....E. 0010 01 80 02 07 00 00 80 32 f8 5d a5 e3 f9 96 a5 e3 .......2.]...... 0020 f9 89 b4 53 95 a5 00 00 00 01 be 92 62 2d 5a 4f ...S........b-ZO 0030 45 ac b9 ac 04 4a ca 29 a4 c5 f5 f8 e6 e0 f6 09 E....J.)........ 0040 f9 c1 e7 a2 02 e0 ed fd 2e 05 6d dd a3 a3 c9 cb ..........m..... 0050 48 f8 d7 92 6e 89 61 a0 57 d9 35 92 73 49 fb e4 H...n.a.W.5.sI.. 0060 51 42 bb b1 ec 96 b6 55 ae e6 4b 4a 9b 9e 5c 25 QB.....U..KJ..\% 0070 c9 b9 a2 fe ad 93 69 3e 31 00 99 da 68 68 89 f3 ......i>1...hh.. 0080 c7 7f 22 3a d4 09 f8 82 5f 97 2c 20 a4 55 7e d9 ..":...._., .U~. 0090 32 22 71 18 21 15 23 5a b2 8d a8 56 4b 3f ad f8 2"q.!.#Z...VK?.. 00a0 dd a5 0e ef 59 05 71 22 24 b5 51 27 23 55 a2 57 ....Y.q"$.Q'#U.W 00b0 91 e1 c7 fc 93 27 d5 f5 25 22 40 5f f2 c7 bc 8f .....'..%"@_.... 00c0 5b c3 0f 77 52 36 00 93 ef ce 55 f3 ad 5f d5 37 [..wR6....U.._.7 00d0 c9 0d 60 fa 89 3d 2d 35 b5 bd ed 2c c8 54 d3 b8 ..`..=-5...,.T.. 00e0 b4 57 16 16 d1 51 35 d0 fe 56 d1 48 d4 4d 1e c2 .W...Q5..V.H.M.. 00f0 0f 17 c0 b1 ab 03 89 1c 65 ed cf 13 0b 68 ac 75 ........e....h.u 0100 35 ab f7 ea 5b f6 92 7b 0e 70 e9 6a e8 29 ef 86 5...[..{.p.j.).. 0110 b2 73 42 78 10 d2 83 df 5f a9 75 98 8d 9a b2 21 .sBx...._.u....! 0120 68 9c e0 3f b3 f5 f1 c2 4d b0 e2 6f 6a 65 4b 50 h..?....M..ojeKP 0130 cf cd 33 27 1a 98 ea 09 5b 0f b7 17 4f 31 62 93 ..3'....[...O1b. 0140 32 33 84 63 d1 c1 6b 31 33 e6 41 91 20 a1 42 e2 23.c..k13.A. .B. 0150 09 69 9f 11 2b d6 5e e6 71 b7 06 7f d9 06 28 29 .i..+.^.q.....() 0160 44 c3 17 71 f0 9c 95 b8 0d 56 03 80 84 04 7e 00 D..q.....V....~. 0170 b7 fe a8 02 69 f5 e4 91 6b 7d 9c 5a 3c d9 a9 4e ....i...k}.Z<..N 0180 81 d5 da e5 af ab 3d 6a b2 fb bd d5 21 9f ......=j....!. Frame 11 (398 bytes on wire, 398 bytes captured) Arrival Time: Aug 14, 2006 12:52:34.658041000 Time delta from previous packet: 0.012800000 seconds Time since reference or first frame: 10.622523000 seconds Frame Number: 11 Packet Length: 398 bytes Capture Length: 398 bytes Protocols in frame: eth:ip:esp:data Ethernet II, Src: 00:0f:b5:c4:e4:ae (00:0f:b5:c4:e4:ae), Dst: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa) Destination: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa) Source: 00:0f:b5:c4:e4:ae (00:0f:b5:c4:e4:ae) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.137 (165.227.249.137), Dst: 165.227.249.150 (165.227.249.150) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 384 Identification: 0x152f (5423) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 29 Protocol: ESP (0x32) Header checksum: 0x4836 [correct] Good: True Bad : False Source: 165.227.249.137 (165.227.249.137) Destination: 165.227.249.150 (165.227.249.150) Encapsulating Security Payload SPI: 0xc921f3e9 Sequence: 1 Data (356 bytes) 0000 00 0c 29 96 e1 fa 00 0f b5 c4 e4 ae 08 00 45 00 ..)...........E. 0010 01 80 15 2f 00 00 1d 32 48 36 a5 e3 f9 89 a5 e3 .../...2H6...... 0020 f9 96 c9 21 f3 e9 00 00 00 01 92 13 f9 5c 4a 02 ...!.........\J. 0030 49 8e 92 7c d9 ea 36 5a 20 70 69 f9 82 89 1f f6 I..|..6Z pi..... 0040 e0 54 09 dc 26 af cf d6 70 53 3f a2 24 da 6d b0 .T..&...pS?.$.m. 0050 d7 66 8b 3c 8d ac 43 6a 65 a4 a5 6d 87 2e fa 10 .f.<..Cje..m.... 0060 05 66 2f d0 c6 bd a3 c2 de 1f 26 f9 4f 66 95 46 .f/.......&.Of.F 0070 92 18 1f 2f 28 33 13 ab b8 ea 79 e2 ae 32 ea b3 .../(3....y..2.. 0080 5a ba 86 ac a6 b3 6f a9 e2 f0 82 64 46 2f 68 9c Z.....o....dF/h. 0090 14 98 4f ee 4e 56 0b 53 49 b2 78 c8 a2 b0 3a 9b ..O.NV.SI.x...:. 00a0 7e dc b4 c2 21 17 63 1c 59 69 e5 c4 95 16 f5 3b ~...!.c.Yi.....; 00b0 95 f2 18 50 1f 23 c2 58 2d 45 df fc c5 e9 92 26 ...P.#.X-E.....& 00c0 96 c6 9f 1d 64 8c cf 4f f5 74 71 47 62 e8 26 6c ....d..O.tqGb.&l 00d0 0e 89 46 bc 7c aa 73 b0 65 25 b2 eb 54 eb 51 e2 ..F.|.s.e%..T.Q. 00e0 ea ea 65 d7 02 53 16 ba b7 36 ea cd f5 10 31 dd ..e..S...6....1. 00f0 b9 80 d3 2e 20 08 5b c3 0d 5f 0a 58 41 59 5c be .... .[.._.XAY\. 0100 33 74 f8 40 03 0d 02 a8 4f 4e fe 04 e8 16 0c c3 3t.@....ON...... 0110 2f 70 9f 62 05 21 f9 96 e8 bf 68 3c d2 d0 48 97 /p.b.!....h<..H. 0120 af c3 e9 64 32 5b dc 45 ea 94 86 5b 8a f2 9f 7b ...d2[.E...[...{ 0130 ae c3 b5 85 d6 1e b9 c8 27 9d 11 c2 01 38 57 68 ........'....8Wh 0140 ed 29 3e 24 ec 67 14 59 af 32 5e dd ea 63 98 12 .)>$.g.Y.2^..c.. 0150 ff de d1 66 37 05 96 57 a4 c4 e6 ce 69 4e a9 77 ...f7..W....iN.w 0160 59 f7 84 99 91 0d c8 24 f5 97 07 49 06 e7 c4 c4 Y......$...I.... 0170 cb 89 c8 23 08 9e f6 2a 8b fc 1e 44 74 3a 7f 31 ...#...*...Dt:.1 0180 a6 7f 4d e3 7d 92 75 d0 17 29 9d 81 57 3c ..M.}.u..)..W<