Frame 1 (222 bytes on wire, 222 bytes captured) Arrival Time: Aug 13, 2006 11:30:24.859642000 Time delta from previous packet: 0.000000000 seconds Time since reference or first frame: 0.000000000 seconds Frame Number: 1 Packet Length: 222 bytes Capture Length: 222 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa), Dst: 00:0f:3d:55:af:fc (00:0f:3d:55:af:fc) Destination: 00:0f:3d:55:af:fc (00:0f:3d:55:af:fc) Source: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.150 (165.227.249.150), Dst: 165.227.249.142 (165.227.249.142) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 208 Identification: 0x01a3 (419) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: UDP (0x11) Header checksum: 0xf98d [correct] Good: True Bad : False Source: 165.227.249.150 (165.227.249.150) Destination: 165.227.249.142 (165.227.249.142) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 188 Checksum: 0xf46a [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0x6C7B12110B3F5849 Responder cookie: 0x0000000000000000 Next payload: Security Association (1) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 180 Security Association payload Next payload: Vendor ID (13) Length: 52 Domain of interpretation: IPSEC (1) Situation: IDENTITY (1) Proposal payload # 1 Next payload: NONE (0) Length: 40 Proposal number: 1 Protocol ID: ISAKMP (1) SPI size: 0 Number of transforms: 1 Transform payload # 1 Next payload: NONE (0) Length: 32 Transform number: 1 Transform ID: KEY_IKE (1) Encryption-Algorithm (1): 3DES-CBC (5) Hash-Algorithm (2): SHA (2) Group-Description (4): Alternate 1024-bit MODP group (2) Authentication-Method (3): PSK (1) Life-Type (11): Seconds (1) Life-Duration (12): Duration-Value (28800) Vendor ID payload Next payload: Vendor ID (13) Length: 20 Vendor ID: unknown vendor ID: 0x4A131C81070358455C5728F20E95452F Vendor ID payload Next payload: Vendor ID (13) Length: 20 Vendor ID: draft-ietf-ipsec-nat-t-ike-03 Vendor ID payload Next payload: Vendor ID (13) Length: 20 Vendor ID: draft-ietf-ipsec-nat-t-ike-02 Vendor ID payload Next payload: Vendor ID (13) Length: 20 Vendor ID: draft-ietf-ipsec-nat-t-ike-00 Vendor ID payload Next payload: NONE (0) Length: 20 Vendor ID: RFC 3706 Detecting Dead IKE Peers (DPD) 0000 00 0f 3d 55 af fc 00 0c 29 96 e1 fa 08 00 45 00 ..=U....).....E. 0010 00 d0 01 a3 00 00 80 11 f9 8d a5 e3 f9 96 a5 e3 ................ 0020 f9 8e 01 f4 01 f4 00 bc f4 6a 6c 7b 12 11 0b 3f .........jl{...? 0030 58 49 00 00 00 00 00 00 00 00 01 10 02 00 00 00 XI.............. 0040 00 00 00 00 00 b4 0d 00 00 34 00 00 00 01 00 00 .........4...... 0050 00 01 00 00 00 28 01 01 00 01 00 00 00 20 01 01 .....(....... .. 0060 00 00 80 01 00 05 80 02 00 02 80 04 00 02 80 03 ................ 0070 00 01 80 0b 00 01 80 0c 70 80 0d 00 00 14 4a 13 ........p.....J. 0080 1c 81 07 03 58 45 5c 57 28 f2 0e 95 45 2f 0d 00 ....XE\W(...E/.. 0090 00 14 7d 94 19 a6 53 10 ca 6f 2c 17 9d 92 15 52 ..}...S..o,....R 00a0 9d 56 0d 00 00 14 90 cb 80 91 3e bb 69 6e 08 63 .V........>.in.c 00b0 81 b5 ec 42 7b 1f 0d 00 00 14 44 85 15 2d 18 b6 ...B{.....D..-.. 00c0 bb cd 0b e8 a8 46 95 79 dd cc 00 00 00 14 af ca .....F.y........ 00d0 d7 13 68 a1 f1 c9 6b 86 96 fc 77 57 01 00 ..h...k...wW.. Frame 2 (262 bytes on wire, 262 bytes captured) Arrival Time: Aug 13, 2006 11:30:24.867798000 Time delta from previous packet: 0.008156000 seconds Time since reference or first frame: 0.008156000 seconds Frame Number: 2 Packet Length: 262 bytes Capture Length: 262 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:0f:3d:55:af:fc (00:0f:3d:55:af:fc), Dst: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa) Destination: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa) Source: 00:0f:3d:55:af:fc (00:0f:3d:55:af:fc) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.142 (165.227.249.142), Dst: 165.227.249.150 (165.227.249.150) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 248 Identification: 0x087d (2173) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 255 Protocol: UDP (0x11) Header checksum: 0x738b [correct] Good: True Bad : False Source: 165.227.249.142 (165.227.249.142) Destination: 165.227.249.150 (165.227.249.150) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 228 Checksum: 0xdf20 [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0x6C7B12110B3F5849 Responder cookie: 0x85563CF9C1C92362 Next payload: Security Association (1) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 220 Security Association payload Next payload: Vendor ID (13) Length: 52 Domain of interpretation: IPSEC (1) Situation: IDENTITY (1) Proposal payload # 1 Next payload: NONE (0) Length: 40 Proposal number: 1 Protocol ID: ISAKMP (1) SPI size: 0 Number of transforms: 1 Transform payload # 1 Next payload: NONE (0) Length: 32 Transform number: 1 Transform ID: KEY_IKE (1) Encryption-Algorithm (1): 3DES-CBC (5) Hash-Algorithm (2): SHA (2) Group-Description (4): Alternate 1024-bit MODP group (2) Authentication-Method (3): PSK (1) Life-Type (11): Seconds (1) Life-Duration (12): Duration-Value (28800) Vendor ID payload Next payload: Vendor ID (13) Length: 20 Vendor ID: RFC 3706 Detecting Dead IKE Peers (DPD) Vendor ID payload Next payload: Vendor ID (13) Length: 20 Vendor ID: draft-stenberg-ipsec-nat-traversal-01 Vendor ID payload Next payload: Vendor ID (13) Length: 20 Vendor ID: draft-stenberg-ipsec-nat-traversal-02 Vendor ID payload Next payload: Vendor ID (13) Length: 20 Vendor ID: draft-ietf-ipsec-nat-t-ike-00 Vendor ID payload Next payload: Vendor ID (13) Length: 20 Vendor ID: draft-ietf-ipsec-nat-t-ike-02 Vendor ID payload Next payload: Vendor ID (13) Length: 20 Vendor ID: draft-ietf-ipsec-nat-t-ike-02 Vendor ID payload Next payload: NONE (0) Length: 20 Vendor ID: draft-ietf-ipsec-nat-t-ike-03 0000 00 0c 29 96 e1 fa 00 0f 3d 55 af fc 08 00 45 00 ..).....=U....E. 0010 00 f8 08 7d 00 00 ff 11 73 8b a5 e3 f9 8e a5 e3 ...}....s....... 0020 f9 96 01 f4 01 f4 00 e4 df 20 6c 7b 12 11 0b 3f ......... l{...? 0030 58 49 85 56 3c f9 c1 c9 23 62 01 10 02 00 00 00 XI.V<...#b...... 0040 00 00 00 00 00 dc 0d 00 00 34 00 00 00 01 00 00 .........4...... 0050 00 01 00 00 00 28 01 01 00 01 00 00 00 20 01 01 .....(....... .. 0060 00 00 80 01 00 05 80 02 00 02 80 04 00 02 80 03 ................ 0070 00 01 80 0b 00 01 80 0c 70 80 0d 00 00 14 af ca ........p....... 0080 d7 13 68 a1 f1 c9 6b 86 96 fc 77 57 01 00 0d 00 ..h...k...wW.... 0090 00 14 27 ba b5 dc 01 ea 07 60 ea 4e 31 90 ac 27 ..'......`.N1..' 00a0 c0 d0 0d 00 00 14 61 05 c4 22 e7 68 47 e4 3f 96 ......a..".hG.?. 00b0 84 80 12 92 ae cd 0d 00 00 14 44 85 15 2d 18 b6 ..........D..-.. 00c0 bb cd 0b e8 a8 46 95 79 dd cc 0d 00 00 14 cd 60 .....F.y.......` 00d0 46 43 35 df 21 f8 7c fd b2 fc 68 b6 a4 48 0d 00 FC5.!.|...h..H.. 00e0 00 14 90 cb 80 91 3e bb 69 6e 08 63 81 b5 ec 42 ......>.in.c...B 00f0 7b 1f 00 00 00 14 7d 94 19 a6 53 10 ca 6f 2c 17 {.....}...S..o,. 0100 9d 92 15 52 9d 56 ...R.V Frame 3 (270 bytes on wire, 270 bytes captured) Arrival Time: Aug 13, 2006 11:30:24.916649000 Time delta from previous packet: 0.048851000 seconds Time since reference or first frame: 0.057007000 seconds Frame Number: 3 Packet Length: 270 bytes Capture Length: 270 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa), Dst: 00:0f:3d:55:af:fc (00:0f:3d:55:af:fc) Destination: 00:0f:3d:55:af:fc (00:0f:3d:55:af:fc) Source: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.150 (165.227.249.150), Dst: 165.227.249.142 (165.227.249.142) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 256 Identification: 0x01a4 (420) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: UDP (0x11) Header checksum: 0xf95c [correct] Good: True Bad : False Source: 165.227.249.150 (165.227.249.150) Destination: 165.227.249.142 (165.227.249.142) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 236 Checksum: 0x7138 [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0x6C7B12110B3F5849 Responder cookie: 0x85563CF9C1C92362 Next payload: Key Exchange (4) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 228 Key Exchange payload Next payload: Nonce (10) Length: 132 Key Exchange Data Nonce payload Next payload: NAT-D (draft-ietf-ipsec-nat-t-ike-01 to 03) (130) Length: 20 Nonce Data NAT-D (draft-ietf-ipsec-nat-t-ike-01 to 03) payload Next payload: NAT-D (draft-ietf-ipsec-nat-t-ike-01 to 03) (130) Length: 24 Hash of address and port: 5D21F85514DA6910E360BD21C37F4C44096B2C06 NAT-D (draft-ietf-ipsec-nat-t-ike-01 to 03) payload Next payload: NONE (0) Length: 24 Hash of address and port: 45A40559749BBE0B0950B011167606F6476D740C 0000 00 0f 3d 55 af fc 00 0c 29 96 e1 fa 08 00 45 00 ..=U....).....E. 0010 01 00 01 a4 00 00 80 11 f9 5c a5 e3 f9 96 a5 e3 .........\...... 0020 f9 8e 01 f4 01 f4 00 ec 71 38 6c 7b 12 11 0b 3f ........q8l{...? 0030 58 49 85 56 3c f9 c1 c9 23 62 04 10 02 00 00 00 XI.V<...#b...... 0040 00 00 00 00 00 e4 0a 00 00 84 69 1c 5d b1 06 23 ..........i.]..# 0050 6e 9a 7c 08 3e af c2 fb 5e e4 cb 2a 23 d6 16 89 n.|.>...^..*#... 0060 47 4a fe 83 f7 ef be 33 b9 a4 7b 02 4f 63 00 61 GJ.....3..{.Oc.a 0070 d0 4d 95 53 68 b2 22 16 92 0a 88 66 0d 3d 25 d4 .M.Sh."....f.=%. 0080 43 fb 65 cb 1e 57 1f 90 95 96 55 24 2d 62 42 2e C.e..W....U$-bB. 0090 40 e2 46 f3 cf 59 7e 4b 73 55 29 eb b0 01 bc c4 @.F..Y~KsU)..... 00a0 40 bc 82 e9 ec 95 ef e3 0c a4 56 ec e7 ec bf 52 @.........V....R 00b0 b3 9b 70 52 3f e3 7e 5e cb 5d 33 84 ea 93 b0 07 ..pR?.~^.]3..... 00c0 a0 ff 89 0d aa 16 17 0f dd da 82 00 00 14 3e ba ..............>. 00d0 f3 d7 5f f5 14 48 78 36 19 91 7a 10 41 f1 82 00 .._..Hx6..z.A... 00e0 00 18 5d 21 f8 55 14 da 69 10 e3 60 bd 21 c3 7f ..]!.U..i..`.!.. 00f0 4c 44 09 6b 2c 06 00 00 00 18 45 a4 05 59 74 9b LD.k,.....E..Yt. 0100 be 0b 09 50 b0 11 16 76 06 f6 47 6d 74 0c ...P...v..Gmt. Frame 4 (342 bytes on wire, 342 bytes captured) Arrival Time: Aug 13, 2006 11:30:25.373187000 Time delta from previous packet: 0.456538000 seconds Time since reference or first frame: 0.513545000 seconds Frame Number: 4 Packet Length: 342 bytes Capture Length: 342 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:0f:3d:55:af:fc (00:0f:3d:55:af:fc), Dst: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa) Destination: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa) Source: 00:0f:3d:55:af:fc (00:0f:3d:55:af:fc) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.142 (165.227.249.142), Dst: 165.227.249.150 (165.227.249.150) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 328 Identification: 0xc37d (50045) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 255 Protocol: UDP (0x11) Header checksum: 0xb83a [correct] Good: True Bad : False Source: 165.227.249.142 (165.227.249.142) Destination: 165.227.249.150 (165.227.249.150) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 308 Checksum: 0x35fa [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0x6C7B12110B3F5849 Responder cookie: 0x85563CF9C1C92362 Next payload: Key Exchange (4) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 300 Key Exchange payload Next payload: Nonce (10) Length: 132 Key Exchange Data Nonce payload Next payload: NAT-D (draft-ietf-ipsec-nat-t-ike-01 to 03) (130) Length: 20 Nonce Data NAT-D (draft-ietf-ipsec-nat-t-ike-01 to 03) payload Next payload: NAT-D (draft-ietf-ipsec-nat-t-ike-01 to 03) (130) Length: 24 Hash of address and port: 45A40559749BBE0B0950B011167606F6476D740C NAT-D (draft-ietf-ipsec-nat-t-ike-01 to 03) payload Next payload: NAT-D (draft-ietf-ipsec-nat-t-ike-01 to 03) (130) Length: 24 Hash of address and port: 7D290F11EB91688BC03963F00E6BD58F1D7D5FCB NAT-D (draft-ietf-ipsec-nat-t-ike-01 to 03) payload Next payload: NAT-D (draft-ietf-ipsec-nat-t-ike-01 to 03) (130) Length: 24 Hash of address and port: D4740AB3DA8AE2DCC050B1C983C982EF92FCB18E NAT-D (draft-ietf-ipsec-nat-t-ike-01 to 03) payload Next payload: NAT-D (draft-ietf-ipsec-nat-t-ike-01 to 03) (130) Length: 24 Hash of address and port: 5D21F85514DA6910E360BD21C37F4C44096B2C06 NAT-D (draft-ietf-ipsec-nat-t-ike-01 to 03) payload Next payload: NONE (0) Length: 24 Hash of address and port: 7D290F11EB91688BC03963F00E6BD58F1D7D5FCB 0000 00 0c 29 96 e1 fa 00 0f 3d 55 af fc 08 00 45 00 ..).....=U....E. 0010 01 48 c3 7d 00 00 ff 11 b8 3a a5 e3 f9 8e a5 e3 .H.}.....:...... 0020 f9 96 01 f4 01 f4 01 34 35 fa 6c 7b 12 11 0b 3f .......45.l{...? 0030 58 49 85 56 3c f9 c1 c9 23 62 04 10 02 00 00 00 XI.V<...#b...... 0040 00 00 00 00 01 2c 0a 00 00 84 fb 8a 67 d4 8b fb .....,......g... 0050 82 39 f3 3b ba 29 18 8b a8 f2 70 a8 8b 24 92 1f .9.;.)....p..$.. 0060 95 8f f9 04 74 a5 61 3a 96 a3 e7 00 10 77 b7 94 ....t.a:.....w.. 0070 82 3c 63 da 7f 52 ef 98 72 f8 25 19 35 ce 2f 08 ..p. 0050 2e a8 2c ca b2 36 5c 05 5c ee 59 43 8e c4 5f e6 ..,..6\.\.YC.._. 0060 e2 3e d5 68 0f 41 93 a6 40 3c 09 87 da 0a .>.h.A..@<.... Frame 7 (334 bytes on wire, 334 bytes captured) Arrival Time: Aug 13, 2006 11:30:25.456178000 Time delta from previous packet: 0.026253000 seconds Time since reference or first frame: 0.596536000 seconds Frame Number: 7 Packet Length: 334 bytes Capture Length: 334 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa), Dst: 00:0f:3d:55:af:fc (00:0f:3d:55:af:fc) Destination: 00:0f:3d:55:af:fc (00:0f:3d:55:af:fc) Source: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.150 (165.227.249.150), Dst: 165.227.249.142 (165.227.249.142) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 320 Identification: 0x01a6 (422) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: UDP (0x11) Header checksum: 0xf91a [correct] Good: True Bad : False Source: 165.227.249.150 (165.227.249.150) Destination: 165.227.249.142 (165.227.249.142) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 300 Checksum: 0x115a [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0x6C7B12110B3F5849 Responder cookie: 0x85563CF9C1C92362 Next payload: Hash (8) Version: 1.0 Exchange type: Quick Mode (32) Flags .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0xD5158657 Length: 292 Encrypted payload (264 bytes) 0000 00 0f 3d 55 af fc 00 0c 29 96 e1 fa 08 00 45 00 ..=U....).....E. 0010 01 40 01 a6 00 00 80 11 f9 1a a5 e3 f9 96 a5 e3 .@.............. 0020 f9 8e 01 f4 01 f4 01 2c 11 5a 6c 7b 12 11 0b 3f .......,.Zl{...? 0030 58 49 85 56 3c f9 c1 c9 23 62 08 10 20 01 d5 15 XI.V<...#b.. ... 0040 86 57 00 00 01 24 78 ef 97 73 31 82 20 54 96 6c .W...$x..s1. T.l 0050 52 ec 98 ef 1c ff 67 23 a8 6a 0f 25 fd 35 e1 d3 R.....g#.j.%.5.. 0060 14 bf f4 62 73 48 7b aa 60 c3 86 a7 9c e8 d1 9d ...bsH{.`....... 0070 2d c1 06 46 0e d0 70 a3 92 1a 89 89 b1 8f 1a 7d -..F..p........} 0080 b4 42 cc 32 e1 82 84 02 0c 3c 10 d0 61 8a 42 0f .B.2.....<..a.B. 0090 bd e7 51 3e b1 1e 7e 6b 4a 73 8d 59 7b 00 e5 27 ..Q>..~kJs.Y{..' 00a0 cb 8e ea 11 65 46 36 8b 8a e2 df fc 7d 3d e7 50 ....eF6.....}=.P 00b0 ac 43 b8 3b 1f 20 94 e4 d4 69 c9 ca 9b cd de 41 .C.;. ...i.....A 00c0 cb d5 c2 d3 70 7a 35 37 a3 9a 67 f9 95 d2 eb 50 ....pz57..g....P 00d0 68 2d f4 30 d6 20 ca 8e 7b 7a f6 fa 26 2b f8 5e h-.0. ..{z..&+.^ 00e0 37 f9 3a d0 06 7a 5c cb 01 18 e4 da f6 79 45 0b 7.:..z\......yE. 00f0 ae 67 13 ee fd 7b 1c e7 f2 73 55 f7 81 ba a3 c3 .g...{...sU..... 0100 4a 52 a0 66 5f a8 8c 53 b1 02 1f ba 09 80 78 21 JR.f_..S......x! 0110 55 a6 31 1d c6 98 9f a9 f8 35 8c f4 5c eb 91 cd U.1......5..\... 0120 c6 fd 65 03 18 ad f1 2d 88 43 5f f3 3b 47 1f f8 ..e....-.C_.;G.. 0130 45 06 e9 ad b6 38 9b fa bd ff 78 ff 33 b7 fb c7 E....8....x.3... 0140 ea 0c 94 c0 5e 76 a9 d3 f2 d1 4f d5 fe 18 ....^v....O... Frame 8 (326 bytes on wire, 326 bytes captured) Arrival Time: Aug 13, 2006 11:30:25.741799000 Time delta from previous packet: 0.285621000 seconds Time since reference or first frame: 0.882157000 seconds Frame Number: 8 Packet Length: 326 bytes Capture Length: 326 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:0f:3d:55:af:fc (00:0f:3d:55:af:fc), Dst: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa) Destination: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa) Source: 00:0f:3d:55:af:fc (00:0f:3d:55:af:fc) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.142 (165.227.249.142), Dst: 165.227.249.150 (165.227.249.150) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 312 Identification: 0x807e (32894) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 255 Protocol: UDP (0x11) Header checksum: 0xfb49 [correct] Good: True Bad : False Source: 165.227.249.142 (165.227.249.142) Destination: 165.227.249.150 (165.227.249.150) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 292 Checksum: 0x9c7a [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0x6C7B12110B3F5849 Responder cookie: 0x85563CF9C1C92362 Next payload: Hash (8) Version: 1.0 Exchange type: Quick Mode (32) Flags .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0xD5158657 Length: 284 Encrypted payload (256 bytes) 0000 00 0c 29 96 e1 fa 00 0f 3d 55 af fc 08 00 45 00 ..).....=U....E. 0010 01 38 80 7e 00 00 ff 11 fb 49 a5 e3 f9 8e a5 e3 .8.~.....I...... 0020 f9 96 01 f4 01 f4 01 24 9c 7a 6c 7b 12 11 0b 3f .......$.zl{...? 0030 58 49 85 56 3c f9 c1 c9 23 62 08 10 20 01 d5 15 XI.V<...#b.. ... 0040 86 57 00 00 01 1c 23 54 ae 54 9c 7f 5d 84 fa 52 .W....#T.T..]..R 0050 1c 86 13 eb 88 a8 c2 c0 da 27 59 ec 65 a0 8e 76 .........'Y.e..v 0060 9a 2c ab fe e2 69 ac 11 df 72 07 18 79 57 47 8f .,...i...r..yWG. 0070 fb c6 f6 30 8a 73 3c 0f 92 39 52 25 1a 93 00 fe ...0.s<..9R%.... 0080 46 57 dc e3 4f 84 b7 af 88 35 e7 7a c7 56 c4 ad FW..O....5.z.V.. 0090 13 04 2d 19 41 a2 43 4f 0f 86 25 e5 c2 42 65 2f ..-.A.CO..%..Be/ 00a0 c4 6a 6e ff 16 0a 49 2a 2c 24 7b a9 46 49 84 73 .jn...I*,${.FI.s 00b0 2a 22 44 fd d3 0f e8 71 80 44 50 43 86 6f f4 54 *"D....q.DPC.o.T 00c0 f1 4c ee 4d 4f ef d4 19 e4 51 e6 ec 18 80 74 31 .L.MO....Q....t1 00d0 22 38 a7 e6 20 f8 ee 61 27 26 9c 89 b5 0c 09 f2 "8.. ..a'&...... 00e0 0e 33 22 fc c9 ed 51 59 c0 36 7a cb f5 56 b5 5a .3"...QY.6z..V.Z 00f0 5a 07 de 4b ae 3b 97 97 67 3b 81 63 28 5e 85 f6 Z..K.;..g;.c(^.. 0100 40 e9 8f e9 5c 8a b6 99 de 9f 79 fb e1 14 af 7f @...\.....y..... 0110 07 e2 29 a4 4e 11 8d d8 d7 83 8a d2 b2 83 09 8d ..).N........... 0120 ef 4a 33 02 5a 65 6a 4e 75 41 cb 01 25 3d 7b 70 .J3.ZejNuA..%={p 0130 69 a2 b0 65 db 53 1b 72 54 54 fd 15 5e 58 2b 6c i..e.S.rTT..^X+l 0140 34 97 68 8a 65 6e 4.h.en Frame 9 (326 bytes on wire, 326 bytes captured) Arrival Time: Aug 13, 2006 11:30:25.895061000 Time delta from previous packet: 0.153262000 seconds Time since reference or first frame: 1.035419000 seconds Frame Number: 9 Packet Length: 326 bytes Capture Length: 326 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:0f:3d:55:af:fc (00:0f:3d:55:af:fc), Dst: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa) Destination: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa) Source: 00:0f:3d:55:af:fc (00:0f:3d:55:af:fc) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.142 (165.227.249.142), Dst: 165.227.249.150 (165.227.249.150) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 312 Identification: 0x6579 (25977) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 255 Protocol: UDP (0x11) Header checksum: 0x164f [correct] Good: True Bad : False Source: 165.227.249.142 (165.227.249.142) Destination: 165.227.249.150 (165.227.249.150) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 292 Checksum: 0x9c7a [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0x6C7B12110B3F5849 Responder cookie: 0x85563CF9C1C92362 Next payload: Hash (8) Version: 1.0 Exchange type: Quick Mode (32) Flags .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0xD5158657 Length: 284 Encrypted payload (256 bytes) 0000 00 0c 29 96 e1 fa 00 0f 3d 55 af fc 08 00 45 00 ..).....=U....E. 0010 01 38 65 79 00 00 ff 11 16 4f a5 e3 f9 8e a5 e3 .8ey.....O...... 0020 f9 96 01 f4 01 f4 01 24 9c 7a 6c 7b 12 11 0b 3f .......$.zl{...? 0030 58 49 85 56 3c f9 c1 c9 23 62 08 10 20 01 d5 15 XI.V<...#b.. ... 0040 86 57 00 00 01 1c 23 54 ae 54 9c 7f 5d 84 fa 52 .W....#T.T..]..R 0050 1c 86 13 eb 88 a8 c2 c0 da 27 59 ec 65 a0 8e 76 .........'Y.e..v 0060 9a 2c ab fe e2 69 ac 11 df 72 07 18 79 57 47 8f .,...i...r..yWG. 0070 fb c6 f6 30 8a 73 3c 0f 92 39 52 25 1a 93 00 fe ...0.s<..9R%.... 0080 46 57 dc e3 4f 84 b7 af 88 35 e7 7a c7 56 c4 ad FW..O....5.z.V.. 0090 13 04 2d 19 41 a2 43 4f 0f 86 25 e5 c2 42 65 2f ..-.A.CO..%..Be/ 00a0 c4 6a 6e ff 16 0a 49 2a 2c 24 7b a9 46 49 84 73 .jn...I*,${.FI.s 00b0 2a 22 44 fd d3 0f e8 71 80 44 50 43 86 6f f4 54 *"D....q.DPC.o.T 00c0 f1 4c ee 4d 4f ef d4 19 e4 51 e6 ec 18 80 74 31 .L.MO....Q....t1 00d0 22 38 a7 e6 20 f8 ee 61 27 26 9c 89 b5 0c 09 f2 "8.. ..a'&...... 00e0 0e 33 22 fc c9 ed 51 59 c0 36 7a cb f5 56 b5 5a .3"...QY.6z..V.Z 00f0 5a 07 de 4b ae 3b 97 97 67 3b 81 63 28 5e 85 f6 Z..K.;..g;.c(^.. 0100 40 e9 8f e9 5c 8a b6 99 de 9f 79 fb e1 14 af 7f @...\.....y..... 0110 07 e2 29 a4 4e 11 8d d8 d7 83 8a d2 b2 83 09 8d ..).N........... 0120 ef 4a 33 02 5a 65 6a 4e 75 41 cb 01 25 3d 7b 70 .J3.ZejNuA..%={p 0130 69 a2 b0 65 db 53 1b 72 54 54 fd 15 5e 58 2b 6c i..e.S.rTT..^X+l 0140 34 97 68 8a 65 6e 4.h.en Frame 10 (102 bytes on wire, 102 bytes captured) Arrival Time: Aug 13, 2006 11:30:25.895063000 Time delta from previous packet: 0.000002000 seconds Time since reference or first frame: 1.035421000 seconds Frame Number: 10 Packet Length: 102 bytes Capture Length: 102 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa), Dst: 00:0f:3d:55:af:fc (00:0f:3d:55:af:fc) Destination: 00:0f:3d:55:af:fc (00:0f:3d:55:af:fc) Source: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.150 (165.227.249.150), Dst: 165.227.249.142 (165.227.249.142) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 88 Identification: 0x01a7 (423) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: UDP (0x11) Header checksum: 0xfa01 [correct] Good: True Bad : False Source: 165.227.249.150 (165.227.249.150) Destination: 165.227.249.142 (165.227.249.142) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 68 Checksum: 0x050a [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0x6C7B12110B3F5849 Responder cookie: 0x85563CF9C1C92362 Next payload: Hash (8) Version: 1.0 Exchange type: Quick Mode (32) Flags .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0xD5158657 Length: 60 Encrypted payload (32 bytes) 0000 00 0f 3d 55 af fc 00 0c 29 96 e1 fa 08 00 45 00 ..=U....).....E. 0010 00 58 01 a7 00 00 80 11 fa 01 a5 e3 f9 96 a5 e3 .X.............. 0020 f9 8e 01 f4 01 f4 00 44 05 0a 6c 7b 12 11 0b 3f .......D..l{...? 0030 58 49 85 56 3c f9 c1 c9 23 62 08 10 20 01 d5 15 XI.V<...#b.. ... 0040 86 57 00 00 00 3c 08 6e 4d d4 96 8b cc bd 99 fc .W...<.nM....... 0050 e1 90 f3 df f7 91 f3 37 82 4c 3f 22 49 eb e1 15 .......7.L?"I... 0060 b5 70 c8 b9 2b df .p..+. Frame 11 (398 bytes on wire, 398 bytes captured) Arrival Time: Aug 13, 2006 11:30:34.767528000 Time delta from previous packet: 8.872465000 seconds Time since reference or first frame: 9.907886000 seconds Frame Number: 11 Packet Length: 398 bytes Capture Length: 398 bytes Protocols in frame: eth:ip:esp:data Ethernet II, Src: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa), Dst: 00:0f:3d:55:af:fc (00:0f:3d:55:af:fc) Destination: 00:0f:3d:55:af:fc (00:0f:3d:55:af:fc) Source: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.150 (165.227.249.150), Dst: 165.227.249.142 (165.227.249.142) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 384 Identification: 0x01a8 (424) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: ESP (0x32) Header checksum: 0xf8b7 [correct] Good: True Bad : False Source: 165.227.249.150 (165.227.249.150) Destination: 165.227.249.142 (165.227.249.142) Encapsulating Security Payload SPI: 0x695f8580 Sequence: 1 Data (356 bytes) 0000 00 0f 3d 55 af fc 00 0c 29 96 e1 fa 08 00 45 00 ..=U....).....E. 0010 01 80 01 a8 00 00 80 32 f8 b7 a5 e3 f9 96 a5 e3 .......2........ 0020 f9 8e 69 5f 85 80 00 00 00 01 bc ce 26 e4 d0 87 ..i_........&... 0030 7d b6 1e f2 b2 77 e2 2c ea c2 68 1b c9 a5 f5 78 }....w.,..h....x 0040 03 1c 7a 21 52 18 fe 8c 89 bf d3 c3 70 43 52 ee ..z!R.......pCR. 0050 5a 0d 75 41 40 ac 3a 56 8a e9 47 14 65 c3 11 e4 Z.uA@.:V..G.e... 0060 98 c1 4f 46 be a5 68 ae db 67 7b 55 cc 03 e2 05 ..OF..h..g{U.... 0070 6e 89 c5 2c c2 67 0d 48 ad f0 45 ec 9b 5a ca 44 n..,.g.H..E..Z.D 0080 ae a1 34 93 5a 9f 39 0e 35 22 a4 06 eb ba cc 3c ..4.Z.9.5".....< 0090 28 76 89 97 6c bf 28 0f 79 9d 86 cc 40 29 73 c0 (v..l.(.y...@)s. 00a0 55 59 e6 32 52 c5 41 62 ee e6 43 57 66 42 96 1f UY.2R.Ab..CWfB.. 00b0 36 62 ff 4c e6 b2 71 05 c7 b7 f8 fd af cb 4a 69 6b.L..q.......Ji 00c0 85 f6 1e 93 c4 4d 3b 64 de 44 07 16 9e d6 ac a7 .....M;d.D...... 00d0 76 64 dc a3 d2 e5 3c 1f 51 83 d9 41 7c 84 5c 00 vd....<.Q..A|.\. 00e0 f4 27 96 0d 7d 73 aa 3f 4f 8c 6e 41 b2 1e 53 bc .'..}s.?O.nA..S. 00f0 6e f0 20 6f 7c 03 84 52 7f 39 22 c2 f9 d4 87 20 n. o|..R.9".... 0100 89 51 db 3f 23 1d c0 f1 54 24 bb b2 20 87 02 d1 .Q.?#...T$.. ... 0110 de 4a 85 ec f0 7a 4c e9 f7 37 73 e1 dd a7 78 11 .J...zL..7s...x. 0120 dd 71 9c 77 56 9b 59 70 e1 ae 6b 34 8e 6f 09 12 .q.wV.Yp..k4.o.. 0130 cd a0 ba 81 f2 9c cf e1 10 3c 37 6d 11 e9 9c 8f .........<7m.... 0140 85 5f 1c 3e 8c b5 5f 3c 34 68 19 52 f9 4e 68 76 ._.>.._<4h.R.Nhv 0150 21 3b 12 a4 50 d8 c3 63 a3 dc b3 4e a4 d8 51 38 !;..P..c...N..Q8 0160 71 0d 3e b0 9e 6d 10 2a 54 be b8 a1 e0 7f e9 b5 q.>..m.*T....... 0170 4d 0c a1 19 78 e4 60 8f ec 70 a5 5e d1 2c a2 9c M...x.`..p.^.,.. 0180 96 71 00 17 52 40 ef 53 54 71 cd c3 63 49 .q..R@.STq..cI Frame 12 (398 bytes on wire, 398 bytes captured) Arrival Time: Aug 13, 2006 11:30:34.776387000 Time delta from previous packet: 0.008859000 seconds Time since reference or first frame: 9.916745000 seconds Frame Number: 12 Packet Length: 398 bytes Capture Length: 398 bytes Protocols in frame: eth:ip:esp:data Ethernet II, Src: 00:0f:3d:55:af:fc (00:0f:3d:55:af:fc), Dst: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa) Destination: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa) Source: 00:0f:3d:55:af:fc (00:0f:3d:55:af:fc) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.142 (165.227.249.142), Dst: 165.227.249.150 (165.227.249.150) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 384 Identification: 0xa27e (41598) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 255 Protocol: ESP (0x32) Header checksum: 0xd8e0 [correct] Good: True Bad : False Source: 165.227.249.142 (165.227.249.142) Destination: 165.227.249.150 (165.227.249.150) Encapsulating Security Payload SPI: 0x0b17bd7b Sequence: 2 Data (356 bytes) 0000 00 0c 29 96 e1 fa 00 0f 3d 55 af fc 08 00 45 00 ..).....=U....E. 0010 01 80 a2 7e 00 00 ff 32 d8 e0 a5 e3 f9 8e a5 e3 ...~...2........ 0020 f9 96 0b 17 bd 7b 00 00 00 02 f5 5d 60 0b 20 aa .....{.....]`. . 0030 33 65 b3 61 42 25 38 87 3d e8 cf a6 5e ee 4d 4f 3e.aB%8.=...^.MO 0040 f5 7b e3 4b 6c c7 5f e4 00 20 13 d6 b2 ad 2d 59 .{.Kl._.. ....-Y 0050 3b 4f 29 80 63 c1 ab 5a d0 c8 bc db 7e 47 81 11 ;O).c..Z....~G.. 0060 89 70 66 c5 c5 ee 46 19 6d 44 97 90 36 c0 b7 00 .pf...F.mD..6... 0070 dc ae 4f 25 24 50 34 11 46 ff 7e e5 f2 17 e3 05 ..O%$P4.F.~..... 0080 4a 2b 6e 69 8d 5c 8a ae 22 97 84 8d 33 e4 ef 64 J+ni.\.."...3..d 0090 e2 9c a7 9e 9c 37 3d 00 a6 f5 9a 6a 3e b9 c5 93 .....7=....j>... 00a0 18 e0 e4 70 bf 5b 77 5d e1 c9 da e4 d2 61 ba 03 ...p.[w].....a.. 00b0 c2 12 20 83 80 7b dd 42 58 e4 c5 cf 0b 39 a3 bd .. ..{.BX....9.. 00c0 9c b5 5b e9 0d 73 5b 2f f3 7d a7 21 e5 6c 69 a3 ..[..s[/.}.!.li. 00d0 b6 e7 50 29 21 51 68 65 db 62 39 a0 bb 95 f8 38 ..P)!Qhe.b9....8 00e0 a1 66 eb 6c bd 7e cf fb fd 51 52 53 28 b1 53 d2 .f.l.~...QRS(.S. 00f0 d7 3d d4 11 47 37 52 83 2b 70 ce f0 33 a9 e4 1b .=..G7R.+p..3... 0100 02 50 18 59 a5 0e 5a c4 f7 a0 04 96 f4 1a 54 17 .P.Y..Z.......T. 0110 95 80 3e a1 69 a2 e3 09 a8 4b 67 08 10 2a 14 8f ..>.i....Kg..*.. 0120 d9 88 63 6b 48 af 8d 09 5c e2 e9 5f 70 15 85 a8 ..ckH...\.._p... 0130 54 9d 08 46 95 4e 6e 28 ba 49 11 a2 dd 81 17 64 T..F.Nn(.I.....d 0140 13 c4 8b da d0 ba 7b b2 12 4b 79 5f bb 1a 37 ae ......{..Ky_..7. 0150 c9 61 3d 7a 44 08 29 e4 77 fa 88 22 26 75 86 97 .a=zD.).w.."&u.. 0160 fa 2d e2 96 86 4f 97 bd 30 ca de 0e 31 d9 0f 61 .-...O..0...1..a 0170 0e 07 cc 03 39 78 6c 90 19 16 a6 ab 45 11 fa 86 ....9xl.....E... 0180 06 f2 05 b2 29 8f 3c df c1 b5 2e 4a dd f4 ....).<....J..