Frame 1 (222 bytes on wire, 222 bytes captured) Arrival Time: Aug 14, 2006 13:04:38.737570000 Time delta from previous packet: 0.000000000 seconds Time since reference or first frame: 0.000000000 seconds Frame Number: 1 Packet Length: 222 bytes Capture Length: 222 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa), Dst: 00:d0:cf:03:6d:13 (00:d0:cf:03:6d:13) Destination: 00:d0:cf:03:6d:13 (00:d0:cf:03:6d:13) Source: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.150 (165.227.249.150), Dst: 165.227.249.139 (165.227.249.139) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 208 Identification: 0x0247 (583) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: UDP (0x11) Header checksum: 0xf8ec [correct] Good: True Bad : False Source: 165.227.249.150 (165.227.249.150) Destination: 165.227.249.139 (165.227.249.139) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 188 Checksum: 0xa3dc [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0xF2B3FE066FB9D231 Responder cookie: 0x0000000000000000 Next payload: Security Association (1) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 180 Security Association payload Next payload: Vendor ID (13) Length: 52 Domain of interpretation: IPSEC (1) Situation: IDENTITY (1) Proposal payload # 1 Next payload: NONE (0) Length: 40 Proposal number: 1 Protocol ID: ISAKMP (1) SPI size: 0 Number of transforms: 1 Transform payload # 1 Next payload: NONE (0) Length: 32 Transform number: 1 Transform ID: KEY_IKE (1) Encryption-Algorithm (1): 3DES-CBC (5) Hash-Algorithm (2): SHA (2) Group-Description (4): Alternate 1024-bit MODP group (2) Authentication-Method (3): PSK (1) Life-Type (11): Seconds (1) Life-Duration (12): Duration-Value (28800) Vendor ID payload Next payload: Vendor ID (13) Length: 20 Vendor ID: unknown vendor ID: 0x4A131C81070358455C5728F20E95452F Vendor ID payload Next payload: Vendor ID (13) Length: 20 Vendor ID: draft-ietf-ipsec-nat-t-ike-03 Vendor ID payload Next payload: Vendor ID (13) Length: 20 Vendor ID: draft-ietf-ipsec-nat-t-ike-02 Vendor ID payload Next payload: Vendor ID (13) Length: 20 Vendor ID: draft-ietf-ipsec-nat-t-ike-00 Vendor ID payload Next payload: NONE (0) Length: 20 Vendor ID: RFC 3706 Detecting Dead IKE Peers (DPD) 0000 00 d0 cf 03 6d 13 00 0c 29 96 e1 fa 08 00 45 00 ....m...).....E. 0010 00 d0 02 47 00 00 80 11 f8 ec a5 e3 f9 96 a5 e3 ...G............ 0020 f9 8b 01 f4 01 f4 00 bc a3 dc f2 b3 fe 06 6f b9 ..............o. 0030 d2 31 00 00 00 00 00 00 00 00 01 10 02 00 00 00 .1.............. 0040 00 00 00 00 00 b4 0d 00 00 34 00 00 00 01 00 00 .........4...... 0050 00 01 00 00 00 28 01 01 00 01 00 00 00 20 01 01 .....(....... .. 0060 00 00 80 01 00 05 80 02 00 02 80 04 00 02 80 03 ................ 0070 00 01 80 0b 00 01 80 0c 70 80 0d 00 00 14 4a 13 ........p.....J. 0080 1c 81 07 03 58 45 5c 57 28 f2 0e 95 45 2f 0d 00 ....XE\W(...E/.. 0090 00 14 7d 94 19 a6 53 10 ca 6f 2c 17 9d 92 15 52 ..}...S..o,....R 00a0 9d 56 0d 00 00 14 90 cb 80 91 3e bb 69 6e 08 63 .V........>.in.c 00b0 81 b5 ec 42 7b 1f 0d 00 00 14 44 85 15 2d 18 b6 ...B{.....D..-.. 00c0 bb cd 0b e8 a8 46 95 79 dd cc 00 00 00 14 af ca .....F.y........ 00d0 d7 13 68 a1 f1 c9 6b 86 96 fc 77 57 01 00 ..h...k...wW.. Frame 2 (162 bytes on wire, 162 bytes captured) Arrival Time: Aug 14, 2006 13:04:38.747562000 Time delta from previous packet: 0.009992000 seconds Time since reference or first frame: 0.009992000 seconds Frame Number: 2 Packet Length: 162 bytes Capture Length: 162 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:d0:cf:03:6d:13 (00:d0:cf:03:6d:13), Dst: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa) Destination: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa) Source: 00:d0:cf:03:6d:13 (00:d0:cf:03:6d:13) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.139 (165.227.249.139), Dst: 165.227.249.150 (165.227.249.150) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 148 Identification: 0x0000 (0) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfb6f [correct] Good: True Bad : False Source: 165.227.249.139 (165.227.249.139) Destination: 165.227.249.150 (165.227.249.150) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 128 Checksum: 0x8f4e [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0xF2B3FE066FB9D231 Responder cookie: 0xFCC5A5727766C276 Next payload: Security Association (1) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 120 Security Association payload Next payload: Vendor ID (13) Length: 52 Domain of interpretation: IPSEC (1) Situation: IDENTITY (1) Proposal payload # 1 Next payload: NONE (0) Length: 40 Proposal number: 1 Protocol ID: ISAKMP (1) SPI size: 0 Number of transforms: 1 Transform payload # 1 Next payload: NONE (0) Length: 32 Transform number: 1 Transform ID: KEY_IKE (1) Encryption-Algorithm (1): 3DES-CBC (5) Hash-Algorithm (2): SHA (2) Group-Description (4): Alternate 1024-bit MODP group (2) Authentication-Method (3): PSK (1) Life-Type (11): Seconds (1) Life-Duration (12): Duration-Value (28800) Vendor ID payload Next payload: Vendor ID (13) Length: 20 Vendor ID: draft-ietf-ipsec-nat-t-ike-03 Vendor ID payload Next payload: NONE (0) Length: 20 Vendor ID: RFC 3706 Detecting Dead IKE Peers (DPD) 0000 00 0c 29 96 e1 fa 00 d0 cf 03 6d 13 08 00 45 00 ..).......m...E. 0010 00 94 00 00 40 00 40 11 fb 6f a5 e3 f9 8b a5 e3 ....@.@..o...... 0020 f9 96 01 f4 01 f4 00 80 8f 4e f2 b3 fe 06 6f b9 .........N....o. 0030 d2 31 fc c5 a5 72 77 66 c2 76 01 10 02 00 00 00 .1...rwf.v...... 0040 00 00 00 00 00 78 0d 00 00 34 00 00 00 01 00 00 .....x...4...... 0050 00 01 00 00 00 28 01 01 00 01 00 00 00 20 01 01 .....(....... .. 0060 00 00 80 01 00 05 80 02 00 02 80 04 00 02 80 03 ................ 0070 00 01 80 0b 00 01 80 0c 70 80 0d 00 00 14 7d 94 ........p.....}. 0080 19 a6 53 10 ca 6f 2c 17 9d 92 15 52 9d 56 00 00 ..S..o,....R.V.. 0090 00 14 af ca d7 13 68 a1 f1 c9 6b 86 96 fc 77 57 ......h...k...wW 00a0 01 00 .. Frame 3 (270 bytes on wire, 270 bytes captured) Arrival Time: Aug 14, 2006 13:04:38.789888000 Time delta from previous packet: 0.042326000 seconds Time since reference or first frame: 0.052318000 seconds Frame Number: 3 Packet Length: 270 bytes Capture Length: 270 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa), Dst: 00:d0:cf:03:6d:13 (00:d0:cf:03:6d:13) Destination: 00:d0:cf:03:6d:13 (00:d0:cf:03:6d:13) Source: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.150 (165.227.249.150), Dst: 165.227.249.139 (165.227.249.139) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 256 Identification: 0x0248 (584) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: UDP (0x11) Header checksum: 0xf8bb [correct] Good: True Bad : False Source: 165.227.249.150 (165.227.249.150) Destination: 165.227.249.139 (165.227.249.139) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 236 Checksum: 0x4276 [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0xF2B3FE066FB9D231 Responder cookie: 0xFCC5A5727766C276 Next payload: Key Exchange (4) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 228 Key Exchange payload Next payload: Nonce (10) Length: 132 Key Exchange Data Nonce payload Next payload: NAT-D (draft-ietf-ipsec-nat-t-ike-01 to 03) (130) Length: 20 Nonce Data NAT-D (draft-ietf-ipsec-nat-t-ike-01 to 03) payload Next payload: NAT-D (draft-ietf-ipsec-nat-t-ike-01 to 03) (130) Length: 24 Hash of address and port: 68CCE3A87302250E0E1C5BDE96A2A8E7BD0DF410 NAT-D (draft-ietf-ipsec-nat-t-ike-01 to 03) payload Next payload: NONE (0) Length: 24 Hash of address and port: 5C8AD96170EBF7F77E8CFA5D77268805E16F07D2 0000 00 d0 cf 03 6d 13 00 0c 29 96 e1 fa 08 00 45 00 ....m...).....E. 0010 01 00 02 48 00 00 80 11 f8 bb a5 e3 f9 96 a5 e3 ...H............ 0020 f9 8b 01 f4 01 f4 00 ec 42 76 f2 b3 fe 06 6f b9 ........Bv....o. 0030 d2 31 fc c5 a5 72 77 66 c2 76 04 10 02 00 00 00 .1...rwf.v...... 0040 00 00 00 00 00 e4 0a 00 00 84 b7 ad 97 b1 a7 a8 ................ 0050 2f 6c 17 42 3f ed d2 5e 9a 67 25 84 d9 bc 5a b1 /l.B?..^.g%...Z. 0060 31 84 3e 93 87 43 b7 54 e8 39 9f fe 6e e0 62 89 1.>..C.T.9..n.b. 0070 96 f5 42 31 2d cb f7 8e 82 1f a5 65 7a b8 dd 12 ..B1-......ez... 0080 73 8e 1c c0 8a a1 4d 46 5d fa 11 87 fd cb 1f 03 s.....MF]....... 0090 2d 9a 49 c9 df 7f 1c aa 6f 8b 3a 31 5a 10 22 7f -.I.....o.:1Z.". 00a0 19 b9 4b a0 9c 28 b7 a2 67 a2 9e 04 55 b4 86 67 ..K..(..g...U..g 00b0 fe d6 c5 9c a5 30 65 69 eb 84 e0 6b 8d af 3e f7 .....0ei...k..>. 00c0 ad 17 15 30 b6 b6 19 c3 da 5b 82 00 00 14 ff 74 ...0.....[.....t 00d0 b5 69 84 62 41 ad 97 94 c3 25 d5 95 a1 3a 82 00 .i.bA....%...:.. 00e0 00 18 68 cc e3 a8 73 02 25 0e 0e 1c 5b de 96 a2 ..h...s.%...[... 00f0 a8 e7 bd 0d f4 10 00 00 00 18 5c 8a d9 61 70 eb ..........\..ap. 0100 f7 f7 7e 8c fa 5d 77 26 88 05 e1 6f 07 d2 ..~..]w&...o.. Frame 4 (270 bytes on wire, 270 bytes captured) Arrival Time: Aug 14, 2006 13:04:39.185205000 Time delta from previous packet: 0.395317000 seconds Time since reference or first frame: 0.447635000 seconds Frame Number: 4 Packet Length: 270 bytes Capture Length: 270 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:d0:cf:03:6d:13 (00:d0:cf:03:6d:13), Dst: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa) Destination: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa) Source: 00:d0:cf:03:6d:13 (00:d0:cf:03:6d:13) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.139 (165.227.249.139), Dst: 165.227.249.150 (165.227.249.150) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 256 Identification: 0x0000 (0) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfb03 [correct] Good: True Bad : False Source: 165.227.249.139 (165.227.249.139) Destination: 165.227.249.150 (165.227.249.150) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 236 Checksum: 0xac87 [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0xF2B3FE066FB9D231 Responder cookie: 0xFCC5A5727766C276 Next payload: Key Exchange (4) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 228 Key Exchange payload Next payload: Nonce (10) Length: 132 Key Exchange Data Nonce payload Next payload: NAT-D (draft-ietf-ipsec-nat-t-ike-01 to 03) (130) Length: 20 Nonce Data NAT-D (draft-ietf-ipsec-nat-t-ike-01 to 03) payload Next payload: NAT-D (draft-ietf-ipsec-nat-t-ike-01 to 03) (130) Length: 24 Hash of address and port: 5C8AD96170EBF7F77E8CFA5D77268805E16F07D2 NAT-D (draft-ietf-ipsec-nat-t-ike-01 to 03) payload Next payload: NONE (0) Length: 24 Hash of address and port: 68CCE3A87302250E0E1C5BDE96A2A8E7BD0DF410 0000 00 0c 29 96 e1 fa 00 d0 cf 03 6d 13 08 00 45 00 ..).......m...E. 0010 01 00 00 00 40 00 40 11 fb 03 a5 e3 f9 8b a5 e3 ....@.@......... 0020 f9 96 01 f4 01 f4 00 ec ac 87 f2 b3 fe 06 6f b9 ..............o. 0030 d2 31 fc c5 a5 72 77 66 c2 76 04 10 02 00 00 00 .1...rwf.v...... 0040 00 00 00 00 00 e4 0a 00 00 84 f9 00 0c 7e fb c9 .............~.. 0050 e5 3f 4e ce 38 6f b7 b7 36 08 2e 29 41 f5 3d bf .?N.8o..6..)A.=. 0060 c2 da ef 2c 92 5e d4 82 b3 91 84 4d a4 ab 90 c9 ...,.^.....M.... 0070 9a 80 99 d4 a0 d8 d3 01 db 92 12 14 19 9c bc dd ................ 0080 59 69 d8 7d f4 a8 c3 30 bc 76 cd 04 b6 38 0a 90 Yi.}...0.v...8.. 0090 92 f6 40 a9 95 63 d7 a4 d7 68 97 1d 9b 05 7d 3a ..@..c...h....}: 00a0 a6 05 2f a4 c8 a5 d7 2a 00 f6 5d eb dd c5 87 ad ../....*..]..... 00b0 98 fc 31 72 e2 0e 6a db f5 78 37 a8 be 75 ec 9b ..1r..j..x7..u.. 00c0 9b 6b da 41 f3 7c 3c 40 bd 8c 82 00 00 14 f6 4c .k.A.|<@.......L 00d0 d1 93 8e 93 b5 65 28 7e 68 e6 e0 39 a9 c1 82 00 .....e(~h..9.... 00e0 00 18 5c 8a d9 61 70 eb f7 f7 7e 8c fa 5d 77 26 ..\..ap...~..]w& 00f0 88 05 e1 6f 07 d2 00 00 00 18 68 cc e3 a8 73 02 ...o......h...s. 0100 25 0e 0e 1c 5b de 96 a2 a8 e7 bd 0d f4 10 %...[......... Frame 5 (142 bytes on wire, 142 bytes captured) Arrival Time: Aug 14, 2006 13:04:39.215834000 Time delta from previous packet: 0.030629000 seconds Time since reference or first frame: 0.478264000 seconds Frame Number: 5 Packet Length: 142 bytes Capture Length: 142 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa), Dst: 00:d0:cf:03:6d:13 (00:d0:cf:03:6d:13) Destination: 00:d0:cf:03:6d:13 (00:d0:cf:03:6d:13) Source: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.150 (165.227.249.150), Dst: 165.227.249.139 (165.227.249.139) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 128 Identification: 0x0249 (585) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: UDP (0x11) Header checksum: 0xf93a [correct] Good: True Bad : False Source: 165.227.249.150 (165.227.249.150) Destination: 165.227.249.139 (165.227.249.139) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 108 Checksum: 0x6ed5 [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0xF2B3FE066FB9D231 Responder cookie: 0xFCC5A5727766C276 Next payload: Identification (5) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 100 Encrypted payload (72 bytes) 0000 00 d0 cf 03 6d 13 00 0c 29 96 e1 fa 08 00 45 00 ....m...).....E. 0010 00 80 02 49 00 00 80 11 f9 3a a5 e3 f9 96 a5 e3 ...I.....:...... 0020 f9 8b 01 f4 01 f4 00 6c 6e d5 f2 b3 fe 06 6f b9 .......ln.....o. 0030 d2 31 fc c5 a5 72 77 66 c2 76 05 10 02 01 00 00 .1...rwf.v...... 0040 00 00 00 00 00 64 10 38 86 39 22 76 da d6 45 b2 .....d.8.9"v..E. 0050 c3 c6 da 40 57 fc bf a3 40 61 63 07 56 e9 73 9e ...@W...@ac.V.s. 0060 9e 71 b1 d7 4d 12 53 4d 54 00 8f 82 05 af 55 24 .q..M.SMT.....U$ 0070 eb 49 84 12 d2 bc bc 80 f4 19 1e 24 1f 2e 19 5a .I.........$...Z 0080 de 4e 7e fc d3 7d 16 12 9e 43 3f 14 9d a2 .N~..}...C?... Frame 6 (110 bytes on wire, 110 bytes captured) Arrival Time: Aug 14, 2006 13:04:39.233653000 Time delta from previous packet: 0.017819000 seconds Time since reference or first frame: 0.496083000 seconds Frame Number: 6 Packet Length: 110 bytes Capture Length: 110 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:d0:cf:03:6d:13 (00:d0:cf:03:6d:13), Dst: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa) Destination: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa) Source: 00:d0:cf:03:6d:13 (00:d0:cf:03:6d:13) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.139 (165.227.249.139), Dst: 165.227.249.150 (165.227.249.150) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 96 Identification: 0x0000 (0) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfba3 [correct] Good: True Bad : False Source: 165.227.249.139 (165.227.249.139) Destination: 165.227.249.150 (165.227.249.150) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 76 Checksum: 0xc90f [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0xF2B3FE066FB9D231 Responder cookie: 0xFCC5A5727766C276 Next payload: Identification (5) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 68 Encrypted payload (40 bytes) 0000 00 0c 29 96 e1 fa 00 d0 cf 03 6d 13 08 00 45 00 ..).......m...E. 0010 00 60 00 00 40 00 40 11 fb a3 a5 e3 f9 8b a5 e3 .`..@.@......... 0020 f9 96 01 f4 01 f4 00 4c c9 0f f2 b3 fe 06 6f b9 .......L......o. 0030 d2 31 fc c5 a5 72 77 66 c2 76 05 10 02 01 00 00 .1...rwf.v...... 0040 00 00 00 00 00 44 de d2 84 37 37 99 53 f8 02 b0 .....D...77.S... 0050 0b 58 31 12 c2 2a e4 b9 45 e3 b6 4c 47 b6 32 4a .X1..*..E..LG.2J 0060 95 2e f1 92 65 f8 c0 b9 3a fd 7f 75 2a b2 ....e...:..u*. Frame 7 (334 bytes on wire, 334 bytes captured) Arrival Time: Aug 14, 2006 13:04:39.237597000 Time delta from previous packet: 0.003944000 seconds Time since reference or first frame: 0.500027000 seconds Frame Number: 7 Packet Length: 334 bytes Capture Length: 334 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa), Dst: 00:d0:cf:03:6d:13 (00:d0:cf:03:6d:13) Destination: 00:d0:cf:03:6d:13 (00:d0:cf:03:6d:13) Source: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.150 (165.227.249.150), Dst: 165.227.249.139 (165.227.249.139) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 320 Identification: 0x024a (586) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: UDP (0x11) Header checksum: 0xf879 [correct] Good: True Bad : False Source: 165.227.249.150 (165.227.249.150) Destination: 165.227.249.139 (165.227.249.139) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 300 Checksum: 0xd778 [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0xF2B3FE066FB9D231 Responder cookie: 0xFCC5A5727766C276 Next payload: Hash (8) Version: 1.0 Exchange type: Quick Mode (32) Flags .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0xE8E8E0F6 Length: 292 Encrypted payload (264 bytes) 0000 00 d0 cf 03 6d 13 00 0c 29 96 e1 fa 08 00 45 00 ....m...).....E. 0010 01 40 02 4a 00 00 80 11 f8 79 a5 e3 f9 96 a5 e3 .@.J.....y...... 0020 f9 8b 01 f4 01 f4 01 2c d7 78 f2 b3 fe 06 6f b9 .......,.x....o. 0030 d2 31 fc c5 a5 72 77 66 c2 76 08 10 20 01 e8 e8 .1...rwf.v.. ... 0040 e0 f6 00 00 01 24 9f c6 0e c5 a5 c1 31 1d 60 ba .....$......1.`. 0050 b4 28 52 4e a5 78 2e 78 1d a1 e0 c9 2d 19 48 5e .(RN.x.x....-.H^ 0060 7e 19 b8 9b be cb f1 3e 83 38 af ba f6 30 c8 10 ~......>.8...0.. 0070 48 bb f2 cb 32 82 ba 31 3d 7a ea 7f d4 3f 3b 3d H...2..1=z...?;= 0080 50 7e 33 e1 99 21 2c ca 32 69 11 d2 0c f9 ce da P~3..!,.2i...... 0090 f6 ba 93 c2 91 6a e5 fd 74 4c eb a5 32 6e 70 9a .....j..tL..2np. 00a0 f7 16 7c 6c ce 07 5d 5e e4 2f a9 90 06 32 9a 59 ..|l..]^./...2.Y 00b0 29 4f 3d 8a 07 e0 a2 ab d5 4e 87 cf c5 4e 5f af )O=......N...N_. 00c0 56 6c a7 60 6f 9e c9 ae d1 b2 51 78 c9 f8 d3 f9 Vl.`o.....Qx.... 00d0 5f 76 4c c1 89 d3 8d b6 25 d7 e3 9f da c4 a4 87 _vL.....%....... 00e0 68 48 4f 34 9b 00 dc da 7e 0f 45 73 8c 60 a4 e5 hHO4....~.Es.`.. 00f0 fd 86 56 44 dc 5d 60 68 2e 37 9d 74 be e3 f8 a6 ..VD.]`h.7.t.... 0100 bf fb 88 f3 73 bb 9d 6c e8 48 0a 2d a4 a8 96 63 ....s..l.H.-...c 0110 0b c7 8b 43 40 d8 a4 e9 ee e3 71 c5 e1 b0 f3 88 ...C@.....q..... 0120 65 37 9b 4f 41 61 56 e2 7c b3 6f b8 90 b6 ce 2a e7.OAaV.|.o....* 0130 14 7e df eb 1d bd b9 85 00 fb 73 9f 88 4c ae 59 .~........s..L.Y 0140 59 4e c8 9a aa b9 11 3a c0 a8 8d 0c 67 ea YN.....:....g. Frame 8 (326 bytes on wire, 326 bytes captured) Arrival Time: Aug 14, 2006 13:04:39.694067000 Time delta from previous packet: 0.456470000 seconds Time since reference or first frame: 0.956497000 seconds Frame Number: 8 Packet Length: 326 bytes Capture Length: 326 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:d0:cf:03:6d:13 (00:d0:cf:03:6d:13), Dst: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa) Destination: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa) Source: 00:d0:cf:03:6d:13 (00:d0:cf:03:6d:13) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.139 (165.227.249.139), Dst: 165.227.249.150 (165.227.249.150) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 312 Identification: 0x0000 (0) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfacb [correct] Good: True Bad : False Source: 165.227.249.139 (165.227.249.139) Destination: 165.227.249.150 (165.227.249.150) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 292 Checksum: 0x0243 [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0xF2B3FE066FB9D231 Responder cookie: 0xFCC5A5727766C276 Next payload: Hash (8) Version: 1.0 Exchange type: Quick Mode (32) Flags .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0xE8E8E0F6 Length: 284 Encrypted payload (256 bytes) 0000 00 0c 29 96 e1 fa 00 d0 cf 03 6d 13 08 00 45 00 ..).......m...E. 0010 01 38 00 00 40 00 40 11 fa cb a5 e3 f9 8b a5 e3 .8..@.@......... 0020 f9 96 01 f4 01 f4 01 24 02 43 f2 b3 fe 06 6f b9 .......$.C....o. 0030 d2 31 fc c5 a5 72 77 66 c2 76 08 10 20 01 e8 e8 .1...rwf.v.. ... 0040 e0 f6 00 00 01 1c 32 7d e9 33 39 a2 19 5d 4c 8e ......2}.39..]L. 0050 97 86 52 1f 6f 89 dc a9 44 a7 e5 3f 19 27 41 81 ..R.o...D..?.'A. 0060 ca 45 5f 22 a2 7d 04 00 79 d8 68 50 55 88 24 23 .E_".}..y.hPU.$# 0070 98 92 79 26 97 c0 b2 85 61 b2 f3 ce bf 52 0b 6b ..y&....a....R.k 0080 a2 71 ba 85 a8 29 7f a9 db 00 2f c0 c5 b0 e8 fc .q...)..../..... 0090 61 ee b8 8e 9e f4 b4 66 35 f8 90 be 19 12 2f 33 a......f5...../3 00a0 a0 b7 36 a1 14 f6 be 40 af 1c 14 50 11 8a b0 5e ..6....@...P...^ 00b0 42 60 3c f1 86 44 09 69 68 68 a0 40 a8 9d 7a 4c B`<..D.ihh.@..zL 00c0 05 09 c8 2e 7c 20 69 aa ad c1 89 d9 30 08 97 fa ....| i.....0... 00d0 bd 75 fc 74 a7 73 7c 56 6c 97 07 fe 8f 34 19 67 .u.t.s|Vl....4.g 00e0 71 4e b0 aa 8b 15 19 73 54 a3 8d 24 ce e9 81 3e qN.....sT..$...> 00f0 43 e6 40 84 2a af 70 bd 84 ef 59 7e df bc cd fb C.@.*.p...Y~.... 0100 31 04 e8 b9 55 ed fd 13 03 ff 1d 7d 16 41 7b 23 1...U......}.A{# 0110 16 3d 94 5a 3b fb 05 2e 54 e4 8a 30 fc 78 2c cc .=.Z;...T..0.x,. 0120 45 1d 5a da 3a 3a a4 ef 43 87 37 5a 3d 77 c0 34 E.Z.::..C.7Z=w.4 0130 ba 1c d8 83 29 ce 1b 6e 7e a3 18 22 d6 fc 08 39 ....)..n~.."...9 0140 9f 1e 40 ee e8 5d ..@..] Frame 9 (102 bytes on wire, 102 bytes captured) Arrival Time: Aug 14, 2006 13:04:39.759387000 Time delta from previous packet: 0.065320000 seconds Time since reference or first frame: 1.021817000 seconds Frame Number: 9 Packet Length: 102 bytes Capture Length: 102 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa), Dst: 00:d0:cf:03:6d:13 (00:d0:cf:03:6d:13) Destination: 00:d0:cf:03:6d:13 (00:d0:cf:03:6d:13) Source: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.150 (165.227.249.150), Dst: 165.227.249.139 (165.227.249.139) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 88 Identification: 0x024b (587) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: UDP (0x11) Header checksum: 0xf960 [correct] Good: True Bad : False Source: 165.227.249.150 (165.227.249.150) Destination: 165.227.249.139 (165.227.249.139) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 68 Checksum: 0xf566 [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0xF2B3FE066FB9D231 Responder cookie: 0xFCC5A5727766C276 Next payload: Hash (8) Version: 1.0 Exchange type: Quick Mode (32) Flags .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0xE8E8E0F6 Length: 60 Encrypted payload (32 bytes) 0000 00 d0 cf 03 6d 13 00 0c 29 96 e1 fa 08 00 45 00 ....m...).....E. 0010 00 58 02 4b 00 00 80 11 f9 60 a5 e3 f9 96 a5 e3 .X.K.....`...... 0020 f9 8b 01 f4 01 f4 00 44 f5 66 f2 b3 fe 06 6f b9 .......D.f....o. 0030 d2 31 fc c5 a5 72 77 66 c2 76 08 10 20 01 e8 e8 .1...rwf.v.. ... 0040 e0 f6 00 00 00 3c 75 8d 07 82 40 06 58 f9 77 27 .....k.. 0160 5b de a7 45 31 d7 3b ea 58 5c 82 e5 b8 a0 ea 5f [..E1.;.X\....._ 0170 7a 25 ac 43 ea 9a 24 0e e3 52 52 c6 fd 38 b3 66 z%.C..$..RR..8.f 0180 b2 3d 1e aa b4 1a 7a 08 b5 9b 96 23 dd 7f .=....z....#.. Frame 11 (398 bytes on wire, 398 bytes captured) Arrival Time: Aug 14, 2006 13:04:44.487592000 Time delta from previous packet: 0.011226000 seconds Time since reference or first frame: 5.750022000 seconds Frame Number: 11 Packet Length: 398 bytes Capture Length: 398 bytes Protocols in frame: eth:ip:esp:data Ethernet II, Src: 00:d0:cf:03:6d:13 (00:d0:cf:03:6d:13), Dst: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa) Destination: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa) Source: 00:d0:cf:03:6d:13 (00:d0:cf:03:6d:13) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.139 (165.227.249.139), Dst: 165.227.249.150 (165.227.249.150) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 384 Identification: 0x74b9 (29881) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: ESP (0x32) Header checksum: 0xc5a9 [correct] Good: True Bad : False Source: 165.227.249.139 (165.227.249.139) Destination: 165.227.249.150 (165.227.249.150) Encapsulating Security Payload SPI: 0x41b5226b Sequence: 1 Data (356 bytes) 0000 00 0c 29 96 e1 fa 00 d0 cf 03 6d 13 08 00 45 00 ..).......m...E. 0010 01 80 74 b9 00 00 40 32 c5 a9 a5 e3 f9 8b a5 e3 ..t...@2........ 0020 f9 96 41 b5 22 6b 00 00 00 01 f4 92 bd 4a de 21 ..A."k.......J.! 0030 7b e9 fa 03 b6 e4 27 36 b5 5c d2 c8 b5 25 18 9b {.....'6.\...%.. 0040 ce e3 a5 21 0c 54 46 b9 05 90 4e 07 a8 73 32 cc ...!.TF...N..s2. 0050 32 a6 af 02 62 c6 e0 2d de 01 af 80 a5 10 2e dc 2...b..-........ 0060 05 71 f9 19 e7 e4 77 fe 13 e7 17 1e a3 f3 9d c8 .q....w......... 0070 62 8c 9e 0f cd 78 5e ea 2d ab a5 70 44 a7 0d 35 b....x^.-..pD..5 0080 c0 38 05 29 16 ee 70 64 16 8e dd 0b 54 a8 28 37 .8.)..pd....T.(7 0090 93 58 b0 2f ca 77 cb 41 01 3a 20 54 94 d1 37 2e .X./.w.A.: T..7. 00a0 90 cf 0a 8c 0c 26 b1 5f 64 06 c9 ca 37 55 97 d7 .....&._d...7U.. 00b0 e7 a2 c8 ba c7 26 d9 e9 e4 52 c7 a1 9c 28 de db .....&...R...(.. 00c0 c5 88 aa f2 3a bb dd e9 ef 31 fb 32 9f 34 56 8c ....:....1.2.4V. 00d0 f0 f2 cc a6 88 06 ec ce c8 0b ef bc 29 c1 1d 6b ............)..k 00e0 c4 77 22 b2 bf 96 ac 8c d5 eb 1b 48 1e 46 17 9c .w"........H.F.. 00f0 fe 3e 28 72 f0 84 f3 a4 22 b1 39 fd de b2 51 ba .>(r....".9...Q. 0100 38 94 1e 27 ad 60 b3 7d e0 ca fe 05 99 44 ea a9 8..'.`.}.....D.. 0110 8a 78 04 03 12 1a c3 97 f4 7a a3 bc ce e8 3e 64 .x.......z....>d 0120 d6 43 d4 64 b4 f3 b8 40 80 72 4e 20 73 9a 22 cc .C.d...@.rN s.". 0130 8b 13 85 b2 5a cf a0 0b ee 00 86 50 0c 82 de 74 ....Z......P...t 0140 65 f6 c3 e2 a3 b7 5b 07 2a 35 ef 23 9a 39 34 81 e.....[.*5.#.94. 0150 47 5e e5 93 32 fe dc 5b 15 fa c2 80 b7 11 e6 d9 G^..2..[........ 0160 58 50 ea 0d 9d 2a a7 1f 87 50 2b 6c 4d ad ee 36 XP...*...P+lM..6 0170 a9 4f a9 3d 47 15 fa bd 1e 2b bf 17 c6 1f 56 b0 .O.=G....+....V. 0180 6f 03 4f c0 28 ae bc 4b 76 43 5a f2 2e fa o.O.(..KvCZ...