Frame 1 (122 bytes on wire, 122 bytes captured) Arrival Time: Aug 14, 2006 14:05:45.424902000 Time delta from previous packet: 0.000000000 seconds Time since reference or first frame: 0.000000000 seconds Frame Number: 1 Packet Length: 122 bytes Capture Length: 122 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 32:e6:b3:4b:ae:76 (32:e6:b3:4b:ae:76), Dst: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa) Destination: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa) Source: 32:e6:b3:4b:ae:76 (32:e6:b3:4b:ae:76) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.138 (165.227.249.138), Dst: 165.227.249.150 (165.227.249.150) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 108 Identification: 0x0000 (0) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfb98 [correct] Good: True Bad : False Source: 165.227.249.138 (165.227.249.138) Destination: 165.227.249.150 (165.227.249.150) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 88 Checksum: 0xc2d4 [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0x2832C42AB33FE56B Responder cookie: 0x0000000000000000 Next payload: Security Association (1) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 80 Security Association payload Next payload: NONE (0) Length: 52 Domain of interpretation: IPSEC (1) Situation: IDENTITY (1) Proposal payload # 0 Next payload: NONE (0) Length: 40 Proposal number: 0 Protocol ID: ISAKMP (1) SPI size: 0 Number of transforms: 1 Transform payload # 0 Next payload: NONE (0) Length: 32 Transform number: 0 Transform ID: KEY_IKE (1) Life-Type (11): Seconds (1) Life-Duration (12): Duration-Value (28800) Encryption-Algorithm (1): 3DES-CBC (5) Hash-Algorithm (2): SHA (2) Authentication-Method (3): PSK (1) Group-Description (4): Alternate 1024-bit MODP group (2) 0000 00 0c 29 96 e1 fa 32 e6 b3 4b ae 76 08 00 45 00 ..)...2..K.v..E. 0010 00 6c 00 00 40 00 40 11 fb 98 a5 e3 f9 8a a5 e3 .l..@.@......... 0020 f9 96 01 f4 01 f4 00 58 c2 d4 28 32 c4 2a b3 3f .......X..(2.*.? 0030 e5 6b 00 00 00 00 00 00 00 00 01 10 02 00 00 00 .k.............. 0040 00 00 00 00 00 50 00 00 00 34 00 00 00 01 00 00 .....P...4...... 0050 00 01 00 00 00 28 00 01 00 01 00 00 00 20 00 01 .....(....... .. 0060 00 00 80 0b 00 01 80 0c 70 80 80 01 00 05 80 02 ........p....... 0070 00 02 80 03 00 01 80 04 00 02 .......... Frame 2 (222 bytes on wire, 222 bytes captured) Arrival Time: Aug 14, 2006 14:05:48.841062000 Time delta from previous packet: 3.416160000 seconds Time since reference or first frame: 3.416160000 seconds Frame Number: 2 Packet Length: 222 bytes Capture Length: 222 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa), Dst: 32:e6:b3:4b:ae:76 (32:e6:b3:4b:ae:76) Destination: 32:e6:b3:4b:ae:76 (32:e6:b3:4b:ae:76) Source: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.150 (165.227.249.150), Dst: 165.227.249.138 (165.227.249.138) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 208 Identification: 0x0300 (768) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: UDP (0x11) Header checksum: 0xf834 [correct] Good: True Bad : False Source: 165.227.249.150 (165.227.249.150) Destination: 165.227.249.138 (165.227.249.138) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 188 Checksum: 0xcfc5 [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0x9C69668EE1D221F3 Responder cookie: 0x0000000000000000 Next payload: Security Association (1) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 180 Security Association payload Next payload: Vendor ID (13) Length: 52 Domain of interpretation: IPSEC (1) Situation: IDENTITY (1) Proposal payload # 1 Next payload: NONE (0) Length: 40 Proposal number: 1 Protocol ID: ISAKMP (1) SPI size: 0 Number of transforms: 1 Transform payload # 1 Next payload: NONE (0) Length: 32 Transform number: 1 Transform ID: KEY_IKE (1) Encryption-Algorithm (1): 3DES-CBC (5) Hash-Algorithm (2): SHA (2) Group-Description (4): Alternate 1024-bit MODP group (2) Authentication-Method (3): PSK (1) Life-Type (11): Seconds (1) Life-Duration (12): Duration-Value (28800) Vendor ID payload Next payload: Vendor ID (13) Length: 20 Vendor ID: unknown vendor ID: 0x4A131C81070358455C5728F20E95452F Vendor ID payload Next payload: Vendor ID (13) Length: 20 Vendor ID: draft-ietf-ipsec-nat-t-ike-03 Vendor ID payload Next payload: Vendor ID (13) Length: 20 Vendor ID: draft-ietf-ipsec-nat-t-ike-02 Vendor ID payload Next payload: Vendor ID (13) Length: 20 Vendor ID: draft-ietf-ipsec-nat-t-ike-00 Vendor ID payload Next payload: NONE (0) Length: 20 Vendor ID: RFC 3706 Detecting Dead IKE Peers (DPD) 0000 32 e6 b3 4b ae 76 00 0c 29 96 e1 fa 08 00 45 00 2..K.v..).....E. 0010 00 d0 03 00 00 00 80 11 f8 34 a5 e3 f9 96 a5 e3 .........4...... 0020 f9 8a 01 f4 01 f4 00 bc cf c5 9c 69 66 8e e1 d2 ...........if... 0030 21 f3 00 00 00 00 00 00 00 00 01 10 02 00 00 00 !............... 0040 00 00 00 00 00 b4 0d 00 00 34 00 00 00 01 00 00 .........4...... 0050 00 01 00 00 00 28 01 01 00 01 00 00 00 20 01 01 .....(....... .. 0060 00 00 80 01 00 05 80 02 00 02 80 04 00 02 80 03 ................ 0070 00 01 80 0b 00 01 80 0c 70 80 0d 00 00 14 4a 13 ........p.....J. 0080 1c 81 07 03 58 45 5c 57 28 f2 0e 95 45 2f 0d 00 ....XE\W(...E/.. 0090 00 14 7d 94 19 a6 53 10 ca 6f 2c 17 9d 92 15 52 ..}...S..o,....R 00a0 9d 56 0d 00 00 14 90 cb 80 91 3e bb 69 6e 08 63 .V........>.in.c 00b0 81 b5 ec 42 7b 1f 0d 00 00 14 44 85 15 2d 18 b6 ...B{.....D..-.. 00c0 bb cd 0b e8 a8 46 95 79 dd cc 00 00 00 14 af ca .....F.y........ 00d0 d7 13 68 a1 f1 c9 6b 86 96 fc 77 57 01 00 ..h...k...wW.. Frame 3 (122 bytes on wire, 122 bytes captured) Arrival Time: Aug 14, 2006 14:05:48.844834000 Time delta from previous packet: 0.003772000 seconds Time since reference or first frame: 3.419932000 seconds Frame Number: 3 Packet Length: 122 bytes Capture Length: 122 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 32:e6:b3:4b:ae:76 (32:e6:b3:4b:ae:76), Dst: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa) Destination: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa) Source: 32:e6:b3:4b:ae:76 (32:e6:b3:4b:ae:76) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.138 (165.227.249.138), Dst: 165.227.249.150 (165.227.249.150) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 108 Identification: 0x0000 (0) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfb98 [correct] Good: True Bad : False Source: 165.227.249.138 (165.227.249.138) Destination: 165.227.249.150 (165.227.249.150) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 88 Checksum: 0x12ff [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0x9C69668EE1D221F3 Responder cookie: 0x66909929987493F1 Next payload: Security Association (1) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 80 Security Association payload Next payload: NONE (0) Length: 52 Domain of interpretation: IPSEC (1) Situation: IDENTITY (1) Proposal payload # 1 Next payload: NONE (0) Length: 40 Proposal number: 1 Protocol ID: ISAKMP (1) SPI size: 0 Number of transforms: 1 Transform payload # 1 Next payload: NONE (0) Length: 32 Transform number: 1 Transform ID: KEY_IKE (1) Encryption-Algorithm (1): 3DES-CBC (5) Hash-Algorithm (2): SHA (2) Group-Description (4): Alternate 1024-bit MODP group (2) Authentication-Method (3): PSK (1) Life-Type (11): Seconds (1) Life-Duration (12): Duration-Value (28800) 0000 00 0c 29 96 e1 fa 32 e6 b3 4b ae 76 08 00 45 00 ..)...2..K.v..E. 0010 00 6c 00 00 40 00 40 11 fb 98 a5 e3 f9 8a a5 e3 .l..@.@......... 0020 f9 96 01 f4 01 f4 00 58 12 ff 9c 69 66 8e e1 d2 .......X...if... 0030 21 f3 66 90 99 29 98 74 93 f1 01 10 02 00 00 00 !.f..).t........ 0040 00 00 00 00 00 50 00 00 00 34 00 00 00 01 00 00 .....P...4...... 0050 00 01 00 00 00 28 01 01 00 01 00 00 00 20 01 01 .....(....... .. 0060 00 00 80 01 00 05 80 02 00 02 80 04 00 02 80 03 ................ 0070 00 01 80 0b 00 01 80 0c 70 80 ........p. Frame 4 (222 bytes on wire, 222 bytes captured) Arrival Time: Aug 14, 2006 14:05:48.871570000 Time delta from previous packet: 0.026736000 seconds Time since reference or first frame: 3.446668000 seconds Frame Number: 4 Packet Length: 222 bytes Capture Length: 222 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa), Dst: 32:e6:b3:4b:ae:76 (32:e6:b3:4b:ae:76) Destination: 32:e6:b3:4b:ae:76 (32:e6:b3:4b:ae:76) Source: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.150 (165.227.249.150), Dst: 165.227.249.138 (165.227.249.138) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 208 Identification: 0x0301 (769) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: UDP (0x11) Header checksum: 0xf833 [correct] Good: True Bad : False Source: 165.227.249.150 (165.227.249.150) Destination: 165.227.249.138 (165.227.249.138) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 188 Checksum: 0x6a21 [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0x9C69668EE1D221F3 Responder cookie: 0x66909929987493F1 Next payload: Key Exchange (4) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 180 Key Exchange payload Next payload: Nonce (10) Length: 132 Key Exchange Data Nonce payload Next payload: NONE (0) Length: 20 Nonce Data 0000 32 e6 b3 4b ae 76 00 0c 29 96 e1 fa 08 00 45 00 2..K.v..).....E. 0010 00 d0 03 01 00 00 80 11 f8 33 a5 e3 f9 96 a5 e3 .........3...... 0020 f9 8a 01 f4 01 f4 00 bc 6a 21 9c 69 66 8e e1 d2 ........j!.if... 0030 21 f3 66 90 99 29 98 74 93 f1 04 10 02 00 00 00 !.f..).t........ 0040 00 00 00 00 00 b4 0a 00 00 84 58 32 ba 70 dc b4 ..........X2.p.. 0050 18 2f 8f 9a 0f 29 f7 76 f3 34 8a d7 d1 92 66 34 ./...).v.4....f4 0060 10 00 fa cb b3 02 80 38 15 c2 9d 2e 76 21 8c c5 .......8....v!.. 0070 df 23 5d ce 81 df dd 82 13 48 21 40 47 ed db 47 .#]......H!@G..G 0080 0c 21 92 a3 5f 9e a9 9b 2e a9 12 6b c3 34 9b da .!.._......k.4.. 0090 6a 74 0d fc d7 9f 1b 7f 1f 4d 80 cf 3a b1 44 9e jt.......M..:.D. 00a0 ed 31 6b 0e ac 81 d4 4f 61 b0 e3 38 31 31 52 18 .1k....Oa..811R. 00b0 70 1a 55 f0 eb 11 91 35 0e a1 20 e7 19 9e 55 38 p.U....5.. ...U8 00c0 d6 44 08 52 df 19 15 77 c6 ed 00 00 00 14 5a 27 .D.R...w......Z' 00d0 e5 25 64 ca c9 41 c7 3d 3e c0 f4 06 7b 3c .%d..A.=>...{< Frame 5 (222 bytes on wire, 222 bytes captured) Arrival Time: Aug 14, 2006 14:05:49.051395000 Time delta from previous packet: 0.179825000 seconds Time since reference or first frame: 3.626493000 seconds Frame Number: 5 Packet Length: 222 bytes Capture Length: 222 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 32:e6:b3:4b:ae:76 (32:e6:b3:4b:ae:76), Dst: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa) Destination: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa) Source: 32:e6:b3:4b:ae:76 (32:e6:b3:4b:ae:76) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.138 (165.227.249.138), Dst: 165.227.249.150 (165.227.249.150) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 208 Identification: 0x0000 (0) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfb34 [correct] Good: True Bad : False Source: 165.227.249.138 (165.227.249.138) Destination: 165.227.249.150 (165.227.249.150) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 188 Checksum: 0x884e [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0x9C69668EE1D221F3 Responder cookie: 0x66909929987493F1 Next payload: Key Exchange (4) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 180 Key Exchange payload Next payload: Nonce (10) Length: 132 Key Exchange Data Nonce payload Next payload: NONE (0) Length: 20 Nonce Data 0000 00 0c 29 96 e1 fa 32 e6 b3 4b ae 76 08 00 45 00 ..)...2..K.v..E. 0010 00 d0 00 00 40 00 40 11 fb 34 a5 e3 f9 8a a5 e3 ....@.@..4...... 0020 f9 96 01 f4 01 f4 00 bc 88 4e 9c 69 66 8e e1 d2 .........N.if... 0030 21 f3 66 90 99 29 98 74 93 f1 04 10 02 00 00 00 !.f..).t........ 0040 00 00 00 00 00 b4 0a 00 00 84 d6 f3 ba d2 43 57 ..............CW 0050 a3 be 21 da 43 6c 85 8e 99 c8 14 a5 ec 78 12 f0 ..!.Cl.......x.. 0060 e1 a9 56 12 e4 83 03 2b d8 80 9b 90 75 86 31 86 ..V....+....u.1. 0070 cd 23 b9 4c 2a a9 a7 52 15 b6 75 9e dc 4a e8 a9 .#.L*..R..u..J.. 0080 94 11 b8 69 cc 3a 8b 01 ed e1 b8 51 f8 b8 d3 bd ...i.:.....Q.... 0090 71 8d 7a 6c cd b5 ca 2a 3d 3e ca d9 9c 85 38 32 q.zl...*=>....82 00a0 b5 d8 e7 dd ad 36 6b 4d 3f d9 a7 51 4f f5 31 de .....6kM?..QO.1. 00b0 1f 7c 31 1a 12 b2 67 30 bb b0 e3 23 48 29 23 53 .|1...g0...#H)#S 00c0 0b 34 89 e4 18 5a 31 a7 5f d0 00 00 00 14 13 6a .4...Z1._......j 00d0 3b e6 58 4e cd b1 a8 79 cb ff 91 1b d5 76 ;.XN...y.....v Frame 6 (142 bytes on wire, 142 bytes captured) Arrival Time: Aug 14, 2006 14:05:49.093855000 Time delta from previous packet: 0.042460000 seconds Time since reference or first frame: 3.668953000 seconds Frame Number: 6 Packet Length: 142 bytes Capture Length: 142 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa), Dst: 32:e6:b3:4b:ae:76 (32:e6:b3:4b:ae:76) Destination: 32:e6:b3:4b:ae:76 (32:e6:b3:4b:ae:76) Source: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.150 (165.227.249.150), Dst: 165.227.249.138 (165.227.249.138) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 128 Identification: 0x0302 (770) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: UDP (0x11) Header checksum: 0xf882 [correct] Good: True Bad : False Source: 165.227.249.150 (165.227.249.150) Destination: 165.227.249.138 (165.227.249.138) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 108 Checksum: 0xecce [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0x9C69668EE1D221F3 Responder cookie: 0x66909929987493F1 Next payload: Identification (5) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 100 Encrypted payload (72 bytes) 0000 32 e6 b3 4b ae 76 00 0c 29 96 e1 fa 08 00 45 00 2..K.v..).....E. 0010 00 80 03 02 00 00 80 11 f8 82 a5 e3 f9 96 a5 e3 ................ 0020 f9 8a 01 f4 01 f4 00 6c ec ce 9c 69 66 8e e1 d2 .......l...if... 0030 21 f3 66 90 99 29 98 74 93 f1 05 10 02 01 00 00 !.f..).t........ 0040 00 00 00 00 00 64 4a 6c 29 cf 71 dc b5 30 c3 e4 .....dJl).q..0.. 0050 92 49 5a 68 fb a4 16 95 53 b6 64 1f fe 62 13 36 .IZh....S.d..b.6 0060 8b 51 d2 5f 5e 81 8a d1 e3 ad 3a b7 12 5b f7 43 .Q._^.....:..[.C 0070 8d b3 12 d6 ba 0f 03 43 4c 2e a2 59 6c 67 ce 5d .......CL..Ylg.] 0080 6e 89 82 74 68 3e 79 88 d5 79 21 5b ad cf n..th>y..y![.. Frame 7 (110 bytes on wire, 110 bytes captured) Arrival Time: Aug 14, 2006 14:05:49.103744000 Time delta from previous packet: 0.009889000 seconds Time since reference or first frame: 3.678842000 seconds Frame Number: 7 Packet Length: 110 bytes Capture Length: 110 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 32:e6:b3:4b:ae:76 (32:e6:b3:4b:ae:76), Dst: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa) Destination: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa) Source: 32:e6:b3:4b:ae:76 (32:e6:b3:4b:ae:76) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.138 (165.227.249.138), Dst: 165.227.249.150 (165.227.249.150) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 96 Identification: 0x0000 (0) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfba4 [correct] Good: True Bad : False Source: 165.227.249.138 (165.227.249.138) Destination: 165.227.249.150 (165.227.249.150) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 76 Checksum: 0xf19b [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0x9C69668EE1D221F3 Responder cookie: 0x66909929987493F1 Next payload: Identification (5) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 68 Encrypted payload (40 bytes) 0000 00 0c 29 96 e1 fa 32 e6 b3 4b ae 76 08 00 45 00 ..)...2..K.v..E. 0010 00 60 00 00 40 00 40 11 fb a4 a5 e3 f9 8a a5 e3 .`..@.@......... 0020 f9 96 01 f4 01 f4 00 4c f1 9b 9c 69 66 8e e1 d2 .......L...if... 0030 21 f3 66 90 99 29 98 74 93 f1 05 10 02 01 00 00 !.f..).t........ 0040 00 00 00 00 00 44 35 71 2f 6f 04 a6 fe ad cf d6 .....D5q/o...... 0050 a8 50 f3 39 81 c3 7a 9f 9e 3f ba ab bf 02 60 6f .P.9..z..?....`o 0060 76 53 ed f8 5a 6a c1 2d 2f 99 8f a2 09 40 vS..Zj.-/....@ Frame 8 (334 bytes on wire, 334 bytes captured) Arrival Time: Aug 14, 2006 14:05:49.144129000 Time delta from previous packet: 0.040385000 seconds Time since reference or first frame: 3.719227000 seconds Frame Number: 8 Packet Length: 334 bytes Capture Length: 334 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa), Dst: 32:e6:b3:4b:ae:76 (32:e6:b3:4b:ae:76) Destination: 32:e6:b3:4b:ae:76 (32:e6:b3:4b:ae:76) Source: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.150 (165.227.249.150), Dst: 165.227.249.138 (165.227.249.138) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 320 Identification: 0x0303 (771) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: UDP (0x11) Header checksum: 0xf7c1 [correct] Good: True Bad : False Source: 165.227.249.150 (165.227.249.150) Destination: 165.227.249.138 (165.227.249.138) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 300 Checksum: 0x5890 [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0x9C69668EE1D221F3 Responder cookie: 0x66909929987493F1 Next payload: Hash (8) Version: 1.0 Exchange type: Quick Mode (32) Flags .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00878839 Length: 292 Encrypted payload (264 bytes) 0000 32 e6 b3 4b ae 76 00 0c 29 96 e1 fa 08 00 45 00 2..K.v..).....E. 0010 01 40 03 03 00 00 80 11 f7 c1 a5 e3 f9 96 a5 e3 .@.............. 0020 f9 8a 01 f4 01 f4 01 2c 58 90 9c 69 66 8e e1 d2 .......,X..if... 0030 21 f3 66 90 99 29 98 74 93 f1 08 10 20 01 00 87 !.f..).t.... ... 0040 88 39 00 00 01 24 24 6c a0 63 91 fe ad 95 ac a1 .9...$$l.c...... 0050 b3 80 01 4b 3c 8d d5 ec ce 55 96 47 de 8b 64 d4 ...K<....U.G..d. 0060 d0 1d d6 94 cf f6 8c e2 cd 62 a1 b7 f8 b0 1f b5 .........b...... 0070 a7 26 cf 83 20 bf 13 d6 79 e4 06 c4 ff 23 8b ed .&.. ...y....#.. 0080 54 a8 a0 3b 1d ce 71 c0 c5 9d 7f f0 05 8e df fb T..;..q......... 0090 ad 88 ce 7a f5 86 5b aa 19 dd 7d cd b3 bd 8f 16 ...z..[...}..... 00a0 db 7f 1e 3d cf 16 f0 47 94 1a b7 bd 64 66 ac 8a ...=...G....df.. 00b0 45 fc e1 65 b7 20 f1 43 85 81 93 7f a3 ec 6e 0d E..e. .C......n. 00c0 9c 55 7f 6e a5 17 a4 7a 4c d9 c9 3a 70 8d ed 12 .U.n...zL..:p... 00d0 b7 39 4e aa a2 03 2c f6 1a c8 5b 4a a6 81 4d eb .9N...,...[J..M. 00e0 10 11 33 f6 21 a0 46 5e 01 d0 30 83 31 52 18 92 ..3.!.F^..0.1R.. 00f0 f6 ee 23 51 5b 60 3b 4a a1 92 8b 50 7d 1e aa 2d ..#Q[`;J...P}..- 0100 b2 23 6f 73 97 d2 44 72 96 5e d1 b0 19 93 44 e4 .#os..Dr.^....D. 0110 a8 d3 a8 7b 00 d2 54 6a 35 c8 ce 58 c5 a2 98 49 ...{..Tj5..X...I 0120 34 f7 f8 3b 66 b4 66 76 0d 64 8c 70 b8 1f 79 56 4..;f.fv.d.p..yV 0130 6b 64 81 19 2e 71 7d 4f 1a 27 13 59 b5 20 1b 2d kd...q}O.'.Y. .- 0140 1c 51 dc 72 2f bd 59 7e 84 b3 f0 7d 4d 8b .Q.r/.Y~...}M. Frame 9 (326 bytes on wire, 326 bytes captured) Arrival Time: Aug 14, 2006 14:05:49.371547000 Time delta from previous packet: 0.227418000 seconds Time since reference or first frame: 3.946645000 seconds Frame Number: 9 Packet Length: 326 bytes Capture Length: 326 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 32:e6:b3:4b:ae:76 (32:e6:b3:4b:ae:76), Dst: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa) Destination: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa) Source: 32:e6:b3:4b:ae:76 (32:e6:b3:4b:ae:76) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.138 (165.227.249.138), Dst: 165.227.249.150 (165.227.249.150) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 312 Identification: 0x0000 (0) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfacc [correct] Good: True Bad : False Source: 165.227.249.138 (165.227.249.138) Destination: 165.227.249.150 (165.227.249.150) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 292 Checksum: 0x74e6 [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0x9C69668EE1D221F3 Responder cookie: 0x66909929987493F1 Next payload: Hash (8) Version: 1.0 Exchange type: Quick Mode (32) Flags .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00878839 Length: 284 Encrypted payload (256 bytes) 0000 00 0c 29 96 e1 fa 32 e6 b3 4b ae 76 08 00 45 00 ..)...2..K.v..E. 0010 01 38 00 00 40 00 40 11 fa cc a5 e3 f9 8a a5 e3 .8..@.@......... 0020 f9 96 01 f4 01 f4 01 24 74 e6 9c 69 66 8e e1 d2 .......$t..if... 0030 21 f3 66 90 99 29 98 74 93 f1 08 10 20 01 00 87 !.f..).t.... ... 0040 88 39 00 00 01 1c d0 55 09 94 25 a7 84 a1 8c 7e .9.....U..%....~ 0050 5f e3 34 a7 71 3e d6 a5 41 98 2e ac a4 8a c4 7a _.4.q>..A......z 0060 bc 80 2b d4 98 85 c6 ff 05 cc 75 eb 8a d7 6c cf ..+.......u...l. 0070 64 72 5d 5c 90 71 52 2b 78 58 bd 36 8b 25 b2 16 dr]\.qR+xX.6.%.. 0080 d2 48 30 d2 23 c6 c0 eb 36 20 2c be 9c 3f 7c 73 .H0.#...6 ,..?|s 0090 cc 16 45 10 e6 6d 26 98 f6 9c 0e b7 1e c1 1b ae ..E..m&......... 00a0 79 36 17 5b 87 96 58 0b 3f 8a 0e 08 28 24 6e 96 y6.[..X.?...($n. 00b0 1b 29 39 fe 21 10 ff 4b 0c ef e8 45 10 c5 86 99 .)9.!..K...E.... 00c0 0d 65 cd 62 cf cf 56 c4 5f 84 23 60 a1 46 82 a2 .e.b..V._.#`.F.. 00d0 36 47 b1 61 75 72 3b 7f b3 5b 31 6f ea 0e ef 0a 6G.aur;..[1o.... 00e0 7b 20 4c 29 f1 32 07 36 9f 53 d3 66 11 b3 1e 08 { L).2.6.S.f.... 00f0 06 99 a8 27 43 63 dc ff 32 eb fe 84 67 43 fc ba ...'Cc..2...gC.. 0100 1a 35 ea fa 96 f8 4e bb ee 62 eb 03 13 e2 6d c8 .5....N..b....m. 0110 12 cd 29 8a 72 77 4d 0f be b5 41 4e ea d1 9c af ..).rwM...AN.... 0120 e7 de 63 9e fd 4f c5 c9 82 d6 99 ef 1e 85 9f f1 ..c..O.......... 0130 d0 f8 db fc 0e ca 55 12 27 90 04 88 69 0d 3a 11 ......U.'...i.:. 0140 13 fe 81 51 c2 7a ...Q.z Frame 10 (102 bytes on wire, 102 bytes captured) Arrival Time: Aug 14, 2006 14:05:49.441818000 Time delta from previous packet: 0.070271000 seconds Time since reference or first frame: 4.016916000 seconds Frame Number: 10 Packet Length: 102 bytes Capture Length: 102 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa), Dst: 32:e6:b3:4b:ae:76 (32:e6:b3:4b:ae:76) Destination: 32:e6:b3:4b:ae:76 (32:e6:b3:4b:ae:76) Source: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.150 (165.227.249.150), Dst: 165.227.249.138 (165.227.249.138) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 88 Identification: 0x0304 (772) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: UDP (0x11) Header checksum: 0xf8a8 [correct] Good: True Bad : False Source: 165.227.249.150 (165.227.249.150) Destination: 165.227.249.138 (165.227.249.138) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 68 Checksum: 0x9fab [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0x9C69668EE1D221F3 Responder cookie: 0x66909929987493F1 Next payload: Hash (8) Version: 1.0 Exchange type: Quick Mode (32) Flags .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00878839 Length: 60 Encrypted payload (32 bytes) 0000 32 e6 b3 4b ae 76 00 0c 29 96 e1 fa 08 00 45 00 2..K.v..).....E. 0010 00 58 03 04 00 00 80 11 f8 a8 a5 e3 f9 96 a5 e3 .X.............. 0020 f9 8a 01 f4 01 f4 00 44 9f ab 9c 69 66 8e e1 d2 .......D...if... 0030 21 f3 66 90 99 29 98 74 93 f1 08 10 20 01 00 87 !.f..).t.... ... 0040 88 39 00 00 00 3c 62 93 21 31 04 40 bd f1 a9 1e .9.....Mw..7.. 0130 79 91 0a d6 dc 99 ad 16 89 1b 60 7a df d9 9f 59 y.........`z...Y 0140 85 8c 9d 53 e5 50 1c 1c c0 98 df 9d a9 93 12 98 ...S.P.......... 0150 f5 31 6d 2b f7 a8 ab 42 6c 62 62 a6 75 a5 11 cf .1m+...Blbb.u... 0160 eb 9b da 78 9e 5e 66 43 1f 15 32 0e c9 b1 98 05 ...x.^fC..2..... 0170 db ce 2b e6 36 75 9d c3 62 47 73 4a 4e d2 31 0a ..+.6u..bGsJN.1. 0180 3a 2b d3 30 8c c2 c0 1f 54 60 c0 05 38 89 :+.0....T`..8. Frame 14 (398 bytes on wire, 398 bytes captured) Arrival Time: Aug 14, 2006 14:05:57.362715000 Time delta from previous packet: 0.003896000 seconds Time since reference or first frame: 11.937813000 seconds Frame Number: 14 Packet Length: 398 bytes Capture Length: 398 bytes Protocols in frame: eth:ip:esp:data Ethernet II, Src: 32:e6:b3:4b:ae:76 (32:e6:b3:4b:ae:76), Dst: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa) Destination: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa) Source: 32:e6:b3:4b:ae:76 (32:e6:b3:4b:ae:76) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.138 (165.227.249.138), Dst: 165.227.249.150 (165.227.249.150) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 384 Identification: 0xc0f0 (49392) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: ESP (0x32) Header checksum: 0x7973 [correct] Good: True Bad : False Source: 165.227.249.138 (165.227.249.138) Destination: 165.227.249.150 (165.227.249.150) Encapsulating Security Payload SPI: 0x3aa7ccb4 Sequence: 1 Data (356 bytes) 0000 00 0c 29 96 e1 fa 32 e6 b3 4b ae 76 08 00 45 00 ..)...2..K.v..E. 0010 01 80 c0 f0 00 00 40 32 79 73 a5 e3 f9 8a a5 e3 ......@2ys...... 0020 f9 96 3a a7 cc b4 00 00 00 01 d0 d1 d2 d3 d4 d5 ..:............. 0030 d6 d7 23 51 d1 f3 f6 13 b0 3a 6c 3a 69 e4 85 bf ..#Q.....:l:i... 0040 69 a3 d8 4a 4c 64 a3 5d 0a 53 59 63 9d 6b fd 4e i..JLd.].SYc.k.N 0050 89 5b a5 0a 22 dd 65 cb 97 a2 71 e9 4d 18 bb 19 .[..".e...q.M... 0060 68 db bd 38 a9 44 76 01 af 14 de c2 c6 9f dd b2 h..8.Dv......... 0070 04 70 04 92 4c 2a cb b5 1a b0 e0 bb 76 34 b4 a5 .p..L*......v4.. 0080 71 c7 1e ed eb c9 39 e6 ed 98 d6 e8 d1 77 a5 d6 q.....9......w.. 0090 68 c0 32 fb 4b e8 78 02 0a bf 37 cb 12 45 88 4b h.2.K.x...7..E.K 00a0 d6 4c 36 1b c6 2b 09 75 10 c4 c1 1c f1 7c b0 35 .L6..+.u.....|.5 00b0 b5 12 ee f2 dc 00 de c1 b2 10 ba 30 8f c5 0d 45 ...........0...E 00c0 b4 87 0f d6 a6 e1 28 61 2e c0 76 22 37 52 17 05 ......(a..v"7R.. 00d0 0f b1 fc 54 4b d4 9a b2 f8 c1 0c ae dc 84 94 1a ...TK........... 00e0 35 d0 fd f0 b6 3b b2 40 df c6 1d bc f4 b0 08 bc 5....;.@........ 00f0 63 f9 4e 61 58 89 0c 88 a0 ff d5 c2 5a 76 f5 06 c.NaX.......Zv.. 0100 95 59 61 58 89 86 d3 c3 5e 6e c3 38 88 30 5c 2f .YaX....^n.8.0\/ 0110 85 d8 2d fc 6a 9f ef f9 16 a1 d8 51 51 a4 40 8a ..-.j......QQ.@. 0120 bb 92 a0 13 5e 43 23 12 65 d8 75 2d f7 59 93 30 ....^C#.e.u-.Y.0 0130 a9 de 11 b0 15 af 1d b5 95 54 da 7f 07 ff 3a 6f .........T....:o 0140 99 9b 45 b3 b1 4e 3f 28 3b 0d f6 2b 0a 96 9e ff ..E..N?(;..+.... 0150 b2 11 2b d1 57 fc ef a5 84 54 41 e5 30 cf 0c ed ..+.W....TA.0... 0160 3e 9d a7 e7 2e 3b 61 fc cd 56 a9 b7 a9 c4 41 00 >....;a..V....A. 0170 c0 e8 6c 32 21 a6 14 7b 44 0d 93 91 8c 63 ad 36 ..l2!..{D....c.6 0180 a1 95 8a 97 33 e2 dc d3 fb 2c cb e5 dd 7d ....3....,...}