Frame 1 (226 bytes on wire, 226 bytes captured) Arrival Time: Aug 15, 2006 13:35:40.046221000 Time delta from previous packet: 0.000000000 seconds Time since reference or first frame: 0.000000000 seconds Frame Number: 1 Packet Length: 226 bytes Capture Length: 226 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa), Dst: 00:05:30:01:80:af (00:05:30:01:80:af) Destination: 00:05:30:01:80:af (00:05:30:01:80:af) Source: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa) Type: IP (0x0800) Frame check sequence: 0x593844d5 [correct] Internet Protocol, Src: 165.227.249.150 (165.227.249.150), Dst: 165.227.249.144 (165.227.249.144) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 208 Identification: 0x0312 (786) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: UDP (0x11) Header checksum: 0xf81c [correct] Good: True Bad : False Source: 165.227.249.150 (165.227.249.150) Destination: 165.227.249.144 (165.227.249.144) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 188 Checksum: 0x5877 [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0x06F070B44E5CB805 Responder cookie: 0x0000000000000000 Next payload: Security Association (1) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 180 Security Association payload Next payload: Vendor ID (13) Length: 52 Domain of interpretation: IPSEC (1) Situation: IDENTITY (1) Proposal payload # 1 Next payload: NONE (0) Length: 40 Proposal number: 1 Protocol ID: ISAKMP (1) SPI size: 0 Number of transforms: 1 Transform payload # 1 Next payload: NONE (0) Length: 32 Transform number: 1 Transform ID: KEY_IKE (1) Encryption-Algorithm (1): 3DES-CBC (5) Hash-Algorithm (2): SHA (2) Group-Description (4): Alternate 1024-bit MODP group (2) Authentication-Method (3): PSK (1) Life-Type (11): Seconds (1) Life-Duration (12): Duration-Value (28800) Vendor ID payload Next payload: Vendor ID (13) Length: 20 Vendor ID: unknown vendor ID: 0x4A131C81070358455C5728F20E95452F Vendor ID payload Next payload: Vendor ID (13) Length: 20 Vendor ID: draft-ietf-ipsec-nat-t-ike-03 Vendor ID payload Next payload: Vendor ID (13) Length: 20 Vendor ID: draft-ietf-ipsec-nat-t-ike-02 Vendor ID payload Next payload: Vendor ID (13) Length: 20 Vendor ID: draft-ietf-ipsec-nat-t-ike-00 Vendor ID payload Next payload: NONE (0) Length: 20 Vendor ID: RFC 3706 Detecting Dead IKE Peers (DPD) 0000 00 05 30 01 80 af 00 0c 29 96 e1 fa 08 00 45 00 ..0.....).....E. 0010 00 d0 03 12 00 00 80 11 f8 1c a5 e3 f9 96 a5 e3 ................ 0020 f9 90 01 f4 01 f4 00 bc 58 77 06 f0 70 b4 4e 5c ........Xw..p.N\ 0030 b8 05 00 00 00 00 00 00 00 00 01 10 02 00 00 00 ................ 0040 00 00 00 00 00 b4 0d 00 00 34 00 00 00 01 00 00 .........4...... 0050 00 01 00 00 00 28 01 01 00 01 00 00 00 20 01 01 .....(....... .. 0060 00 00 80 01 00 05 80 02 00 02 80 04 00 02 80 03 ................ 0070 00 01 80 0b 00 01 80 0c 70 80 0d 00 00 14 4a 13 ........p.....J. 0080 1c 81 07 03 58 45 5c 57 28 f2 0e 95 45 2f 0d 00 ....XE\W(...E/.. 0090 00 14 7d 94 19 a6 53 10 ca 6f 2c 17 9d 92 15 52 ..}...S..o,....R 00a0 9d 56 0d 00 00 14 90 cb 80 91 3e bb 69 6e 08 63 .V........>.in.c 00b0 81 b5 ec 42 7b 1f 0d 00 00 14 44 85 15 2d 18 b6 ...B{.....D..-.. 00c0 bb cd 0b e8 a8 46 95 79 dd cc 00 00 00 14 af ca .....F.y........ 00d0 d7 13 68 a1 f1 c9 6b 86 96 fc 77 57 01 00 59 38 ..h...k...wW..Y8 00e0 44 d5 D. Frame 2 (126 bytes on wire, 126 bytes captured) Arrival Time: Aug 15, 2006 13:35:40.048276000 Time delta from previous packet: 0.002055000 seconds Time since reference or first frame: 0.002055000 seconds Frame Number: 2 Packet Length: 126 bytes Capture Length: 126 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:05:30:01:80:af (00:05:30:01:80:af), Dst: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa) Destination: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa) Source: 00:05:30:01:80:af (00:05:30:01:80:af) Type: IP (0x0800) Frame check sequence: 0xaa84b60a [correct] Internet Protocol, Src: 165.227.249.144 (165.227.249.144), Dst: 165.227.249.150 (165.227.249.150) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 108 Identification: 0x0000 (0) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0x3b93 [correct] Good: True Bad : False Source: 165.227.249.144 (165.227.249.144) Destination: 165.227.249.150 (165.227.249.150) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 88 Checksum: 0x03ac [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0x06F070B44E5CB805 Responder cookie: 0x811534DC4CEEC144 Next payload: Security Association (1) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 80 Security Association payload Next payload: NONE (0) Length: 52 Domain of interpretation: IPSEC (1) Situation: IDENTITY (1) Proposal payload # 1 Next payload: NONE (0) Length: 40 Proposal number: 1 Protocol ID: ISAKMP (1) SPI size: 0 Number of transforms: 1 Transform payload # 1 Next payload: NONE (0) Length: 32 Transform number: 1 Transform ID: KEY_IKE (1) Encryption-Algorithm (1): 3DES-CBC (5) Hash-Algorithm (2): SHA (2) Group-Description (4): Alternate 1024-bit MODP group (2) Authentication-Method (3): PSK (1) Life-Type (11): Seconds (1) Life-Duration (12): Duration-Value (28800) 0000 00 0c 29 96 e1 fa 00 05 30 01 80 af 08 00 45 00 ..).....0.....E. 0010 00 6c 00 00 00 00 40 11 3b 93 a5 e3 f9 90 a5 e3 .l....@.;....... 0020 f9 96 01 f4 01 f4 00 58 03 ac 06 f0 70 b4 4e 5c .......X....p.N\ 0030 b8 05 81 15 34 dc 4c ee c1 44 01 10 02 00 00 00 ....4.L..D...... 0040 00 00 00 00 00 50 00 00 00 34 00 00 00 01 00 00 .....P...4...... 0050 00 01 00 00 00 28 01 01 00 01 00 00 00 20 01 01 .....(....... .. 0060 00 00 80 01 00 05 80 02 00 02 80 04 00 02 80 03 ................ 0070 00 01 80 0b 00 01 80 0c 70 80 aa 84 b6 0a ........p..... Frame 3 (226 bytes on wire, 226 bytes captured) Arrival Time: Aug 15, 2006 13:35:40.119441000 Time delta from previous packet: 0.071165000 seconds Time since reference or first frame: 0.073220000 seconds Frame Number: 3 Packet Length: 226 bytes Capture Length: 226 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa), Dst: 00:05:30:01:80:af (00:05:30:01:80:af) Destination: 00:05:30:01:80:af (00:05:30:01:80:af) Source: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa) Type: IP (0x0800) Frame check sequence: 0x33c96489 [correct] Internet Protocol, Src: 165.227.249.150 (165.227.249.150), Dst: 165.227.249.144 (165.227.249.144) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 208 Identification: 0x0313 (787) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: UDP (0x11) Header checksum: 0xf81b [correct] Good: True Bad : False Source: 165.227.249.150 (165.227.249.150) Destination: 165.227.249.144 (165.227.249.144) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 188 Checksum: 0x6f86 [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0x06F070B44E5CB805 Responder cookie: 0x811534DC4CEEC144 Next payload: Key Exchange (4) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 180 Key Exchange payload Next payload: Nonce (10) Length: 132 Key Exchange Data Nonce payload Next payload: NONE (0) Length: 20 Nonce Data 0000 00 05 30 01 80 af 00 0c 29 96 e1 fa 08 00 45 00 ..0.....).....E. 0010 00 d0 03 13 00 00 80 11 f8 1b a5 e3 f9 96 a5 e3 ................ 0020 f9 90 01 f4 01 f4 00 bc 6f 86 06 f0 70 b4 4e 5c ........o...p.N\ 0030 b8 05 81 15 34 dc 4c ee c1 44 04 10 02 00 00 00 ....4.L..D...... 0040 00 00 00 00 00 b4 0a 00 00 84 5a 94 89 4d fd 87 ..........Z..M.. 0050 4f 8f 09 68 23 66 47 2b c0 9e 5b a6 4c e6 e2 73 O..h#fG+..[.L..s 0060 26 2e 97 7b da 37 19 d1 ec 8e 83 be bf 12 94 66 &..{.7.........f 0070 94 c8 7a c4 32 e3 87 39 83 95 92 b1 21 79 2d 17 ..z.2..9....!y-. 0080 cd 05 d2 d0 b6 ee a0 8c 75 29 95 b0 2a 35 2c a0 ........u)..*5,. 0090 2a 9e 31 51 29 d2 e7 92 9d e9 93 13 93 47 f3 51 *.1Q)........G.Q 00a0 54 00 d2 ae 8b 73 c8 9c 85 f6 6b 62 c9 fc 3a b2 T....s....kb..:. 00b0 e8 9b 2b 2f d8 65 f0 b6 d8 3f fe a9 6c f2 1c 5c ..+/.e...?..l..\ 00c0 8e d6 94 08 16 bd 24 7b b5 ae 00 00 00 14 e4 d6 ......${........ 00d0 5b 54 52 71 69 93 3e ce 54 2e 06 4e 8e f0 33 c9 [TRqi.>.T..N..3. 00e0 64 89 d. Frame 4 (226 bytes on wire, 226 bytes captured) Arrival Time: Aug 15, 2006 13:35:40.142051000 Time delta from previous packet: 0.022610000 seconds Time since reference or first frame: 0.095830000 seconds Frame Number: 4 Packet Length: 226 bytes Capture Length: 226 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:05:30:01:80:af (00:05:30:01:80:af), Dst: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa) Destination: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa) Source: 00:05:30:01:80:af (00:05:30:01:80:af) Type: IP (0x0800) Frame check sequence: 0x39526de2 [correct] Internet Protocol, Src: 165.227.249.144 (165.227.249.144), Dst: 165.227.249.150 (165.227.249.150) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 208 Identification: 0x0000 (0) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0x3b2f [correct] Good: True Bad : False Source: 165.227.249.144 (165.227.249.144) Destination: 165.227.249.150 (165.227.249.150) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 188 Checksum: 0x5114 [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0x06F070B44E5CB805 Responder cookie: 0x811534DC4CEEC144 Next payload: Key Exchange (4) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 180 Key Exchange payload Next payload: Nonce (10) Length: 132 Key Exchange Data Nonce payload Next payload: NONE (0) Length: 20 Nonce Data 0000 00 0c 29 96 e1 fa 00 05 30 01 80 af 08 00 45 00 ..).....0.....E. 0010 00 d0 00 00 00 00 40 11 3b 2f a5 e3 f9 90 a5 e3 ......@.;/...... 0020 f9 96 01 f4 01 f4 00 bc 51 14 06 f0 70 b4 4e 5c ........Q...p.N\ 0030 b8 05 81 15 34 dc 4c ee c1 44 04 10 02 00 00 00 ....4.L..D...... 0040 00 00 00 00 00 b4 0a 00 00 84 fc 3a 90 58 8f cd ...........:.X.. 0050 f2 0c 4b 34 8d e7 75 3c ad 5a ed 69 52 34 b9 a6 ..K4..u<.Z.iR4.. 0060 dd 2e 41 76 91 76 42 5e bf 95 a1 85 60 29 fc 4b ..Av.vB^....`).K 0070 6e 20 51 43 46 d0 8c 6f 9d d8 a4 aa 2c 8e 03 17 n QCF..o....,... 0080 11 22 3b 9d cc d0 03 3c e6 73 04 5b 93 05 bf 65 .";....<.s.[...e 0090 9e 21 fe e0 96 71 35 ec 1b fd b5 9c df a7 4f d1 .!...q5.......O. 00a0 ca ed ab d7 ee 42 c1 86 e0 56 48 ad de c9 d4 65 .....B...VH....e 00b0 75 9c a4 68 84 78 15 9e 65 cc fa d7 a1 6b 33 16 u..h.x..e....k3. 00c0 11 ac a5 48 a7 cc 17 8b d2 73 00 00 00 14 b8 ac ...H.....s...... 00d0 8f 37 15 04 dd 6a 3d cd 67 12 52 a8 33 ad 39 52 .7...j=.g.R.3.9R 00e0 6d e2 m. Frame 5 (146 bytes on wire, 146 bytes captured) Arrival Time: Aug 15, 2006 13:35:40.301240000 Time delta from previous packet: 0.159189000 seconds Time since reference or first frame: 0.255019000 seconds Frame Number: 5 Packet Length: 146 bytes Capture Length: 146 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa), Dst: 00:05:30:01:80:af (00:05:30:01:80:af) Destination: 00:05:30:01:80:af (00:05:30:01:80:af) Source: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa) Type: IP (0x0800) Frame check sequence: 0x9fa5100d [correct] Internet Protocol, Src: 165.227.249.150 (165.227.249.150), Dst: 165.227.249.144 (165.227.249.144) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 128 Identification: 0x0314 (788) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: UDP (0x11) Header checksum: 0xf86a [correct] Good: True Bad : False Source: 165.227.249.150 (165.227.249.150) Destination: 165.227.249.144 (165.227.249.144) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 108 Checksum: 0x9bfd [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0x06F070B44E5CB805 Responder cookie: 0x811534DC4CEEC144 Next payload: Identification (5) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 100 Encrypted payload (72 bytes) 0000 00 05 30 01 80 af 00 0c 29 96 e1 fa 08 00 45 00 ..0.....).....E. 0010 00 80 03 14 00 00 80 11 f8 6a a5 e3 f9 96 a5 e3 .........j...... 0020 f9 90 01 f4 01 f4 00 6c 9b fd 06 f0 70 b4 4e 5c .......l....p.N\ 0030 b8 05 81 15 34 dc 4c ee c1 44 05 10 02 01 00 00 ....4.L..D...... 0040 00 00 00 00 00 64 7f 97 59 e3 2c 5a 5b 2d 74 b3 .....d..Y.,Z[-t. 0050 bc 29 d9 89 a3 01 de e2 9e e2 97 9e 8f bb 7d fb .)............}. 0060 0e 93 5b 9f 56 fd 87 55 8e 8b 59 76 72 64 84 75 ..[.V..U..Yvrd.u 0070 9b 6a aa df a0 0d 86 8c 75 cb a7 c9 54 eb 0f 11 .j......u...T... 0080 57 c7 d3 e1 f1 6d be e5 04 fe 52 1c 5c 2d 9f a5 W....m....R.\-.. 0090 10 0d .. Frame 6 (114 bytes on wire, 114 bytes captured) Arrival Time: Aug 15, 2006 13:35:40.303738000 Time delta from previous packet: 0.002498000 seconds Time since reference or first frame: 0.257517000 seconds Frame Number: 6 Packet Length: 114 bytes Capture Length: 114 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:05:30:01:80:af (00:05:30:01:80:af), Dst: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa) Destination: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa) Source: 00:05:30:01:80:af (00:05:30:01:80:af) Type: IP (0x0800) Frame check sequence: 0x570f1df6 [correct] Internet Protocol, Src: 165.227.249.144 (165.227.249.144), Dst: 165.227.249.150 (165.227.249.150) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 96 Identification: 0x0000 (0) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0x3b9f [correct] Good: True Bad : False Source: 165.227.249.144 (165.227.249.144) Destination: 165.227.249.150 (165.227.249.150) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 76 Checksum: 0x291e [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0x06F070B44E5CB805 Responder cookie: 0x811534DC4CEEC144 Next payload: Identification (5) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 68 Encrypted payload (40 bytes) 0000 00 0c 29 96 e1 fa 00 05 30 01 80 af 08 00 45 00 ..).....0.....E. 0010 00 60 00 00 00 00 40 11 3b 9f a5 e3 f9 90 a5 e3 .`....@.;....... 0020 f9 96 01 f4 01 f4 00 4c 29 1e 06 f0 70 b4 4e 5c .......L)...p.N\ 0030 b8 05 81 15 34 dc 4c ee c1 44 05 10 02 01 00 00 ....4.L..D...... 0040 00 00 00 00 00 44 72 90 35 2c fe b3 aa a6 b4 70 .....Dr.5,.....p 0050 54 79 42 f7 e3 a3 21 2a a9 c4 fc b8 df c7 5c e8 TyB...!*......\. 0060 44 c1 4d 4b d2 95 85 77 e8 98 84 66 6d d3 57 0f D.MK...w...fm.W. 0070 1d f6 .. Frame 7 (330 bytes on wire, 330 bytes captured) Arrival Time: Aug 15, 2006 13:35:40.403262000 Time delta from previous packet: 0.099524000 seconds Time since reference or first frame: 0.357041000 seconds Frame Number: 7 Packet Length: 330 bytes Capture Length: 330 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa), Dst: 00:05:30:01:80:af (00:05:30:01:80:af) Destination: 00:05:30:01:80:af (00:05:30:01:80:af) Source: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa) Type: IP (0x0800) Frame check sequence: 0xb5b21922 [correct] Internet Protocol, Src: 165.227.249.150 (165.227.249.150), Dst: 165.227.249.144 (165.227.249.144) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 312 Identification: 0x0315 (789) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: UDP (0x11) Header checksum: 0xf7b1 [correct] Good: True Bad : False Source: 165.227.249.150 (165.227.249.150) Destination: 165.227.249.144 (165.227.249.144) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 292 Checksum: 0x87ff [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0x06F070B44E5CB805 Responder cookie: 0x811534DC4CEEC144 Next payload: Hash (8) Version: 1.0 Exchange type: Quick Mode (32) Flags .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x91BF3510 Length: 284 Encrypted payload (256 bytes) 0000 00 05 30 01 80 af 00 0c 29 96 e1 fa 08 00 45 00 ..0.....).....E. 0010 01 38 03 15 00 00 80 11 f7 b1 a5 e3 f9 96 a5 e3 .8.............. 0020 f9 90 01 f4 01 f4 01 24 87 ff 06 f0 70 b4 4e 5c .......$....p.N\ 0030 b8 05 81 15 34 dc 4c ee c1 44 08 10 20 01 91 bf ....4.L..D.. ... 0040 35 10 00 00 01 1c 92 80 65 df ec c2 9f 4a da 39 5.......e....J.9 0050 19 c9 e2 97 dd 9d ca 62 56 f9 f8 ca 48 d9 0c a7 .......bV...H... 0060 be 99 0a 69 6d c2 87 4b b5 60 9f 7b 8b 48 5e 46 ...im..K.`.{.H^F 0070 a9 98 fd 70 56 39 97 01 18 24 8d 20 ac f9 bc c6 ...pV9...$. .... 0080 ac 93 9f 10 c8 f5 ad 53 b9 8a f5 60 c2 10 26 08 .......S...`..&. 0090 5d 5d be 9f 94 39 5e 23 fa 86 0e 30 b5 4f 15 7c ]]...9^#...0.O.| 00a0 61 94 b3 13 26 79 96 39 5b de 70 d8 99 e5 58 5b a...&y.9[.p...X[ 00b0 33 aa d9 13 80 09 8e fa 43 f2 65 48 1d 09 7f 9d 3.......C.eH.... 00c0 3c 2c 2d 5f 95 00 7d 44 c5 c4 4f 64 d4 1e 23 62 <,-_..}D..Od..#b 00d0 d8 b9 03 e3 ce 95 b6 95 e6 dd 4e a0 1e d9 3c 24 ..........N...<$ 00e0 c8 bd 47 4e 58 3a c5 f7 46 c8 18 fb e3 7d ea 2d ..GNX:..F....}.- 00f0 c2 c2 b3 58 be 39 51 16 2c 09 22 23 e8 41 17 d7 ...X.9Q.,."#.A.. 0100 25 8a 0e a0 a4 72 d3 e6 96 6d ae e9 e7 fa b4 11 %....r...m...... 0110 9e bc 84 61 27 a7 94 65 ff e4 26 aa 70 ee c4 a6 ...a'..e..&.p... 0120 e4 25 7c 82 ca be 1b a8 4a 0c f2 45 5d 4c 9e a6 .%|.....J..E]L.. 0130 0c d0 13 c6 d4 b1 41 3e 57 d5 31 e5 86 27 e9 16 ......A>W.1..'.. 0140 08 2d 2c 2c 35 4f b5 b2 19 22 .-,,5O..." Frame 8 (330 bytes on wire, 330 bytes captured) Arrival Time: Aug 15, 2006 13:35:40.475622000 Time delta from previous packet: 0.072360000 seconds Time since reference or first frame: 0.429401000 seconds Frame Number: 8 Packet Length: 330 bytes Capture Length: 330 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:05:30:01:80:af (00:05:30:01:80:af), Dst: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa) Destination: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa) Source: 00:05:30:01:80:af (00:05:30:01:80:af) Type: IP (0x0800) Frame check sequence: 0x7b6e6e31 [correct] Internet Protocol, Src: 165.227.249.144 (165.227.249.144), Dst: 165.227.249.150 (165.227.249.150) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 312 Identification: 0x0000 (0) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0x3ac7 [correct] Good: True Bad : False Source: 165.227.249.144 (165.227.249.144) Destination: 165.227.249.150 (165.227.249.150) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 292 Checksum: 0x53cc [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0x06F070B44E5CB805 Responder cookie: 0x811534DC4CEEC144 Next payload: Hash (8) Version: 1.0 Exchange type: Quick Mode (32) Flags .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x91BF3510 Length: 284 Encrypted payload (256 bytes) 0000 00 0c 29 96 e1 fa 00 05 30 01 80 af 08 00 45 00 ..).....0.....E. 0010 01 38 00 00 00 00 40 11 3a c7 a5 e3 f9 90 a5 e3 .8....@.:....... 0020 f9 96 01 f4 01 f4 01 24 53 cc 06 f0 70 b4 4e 5c .......$S...p.N\ 0030 b8 05 81 15 34 dc 4c ee c1 44 08 10 20 01 91 bf ....4.L..D.. ... 0040 35 10 00 00 01 1c e5 43 43 cf 09 e3 f6 80 79 a6 5......CC.....y. 0050 98 88 18 c5 43 71 25 90 bf 87 b9 f5 9f b2 cd 6f ....Cq%........o 0060 0c 5d ef 6f b4 c5 c4 e5 fc fb 38 bd de cd 20 94 .].o......8... . 0070 84 c4 2e 9c ca a8 f3 c0 09 ec fd 15 c0 00 1c b4 ................ 0080 b4 ab 36 79 d1 3d 57 1a df 19 98 51 dc 44 63 e2 ..6y.=W....Q.Dc. 0090 78 38 7b 39 f1 04 cc 44 01 dc d6 7c 07 8e 3e a2 x8{9...D...|..>. 00a0 29 5b c7 a2 71 bb a7 a3 53 f3 ce ef 43 bc e1 06 )[..q...S...C... 00b0 9b 47 fc b1 38 e2 5e 24 8a f9 ff 83 6f 14 e3 0e .G..8.^$....o... 00c0 db ac b8 5b 14 8b 69 85 69 9d 12 84 e7 cb 77 65 ...[..i.i.....we 00d0 9d 68 84 e5 32 de b3 5a 8a 7f da 39 5c d9 f2 80 .h..2..Z...9\... 00e0 dd 10 7d 1a 0e 34 14 a5 ab c8 65 1c 44 2b 3e 91 ..}..4....e.D+>. 00f0 25 2c 46 ec 0b a0 e0 c3 e4 d4 aa 6e 5c 3a 69 cf %,F........n\:i. 0100 6a 64 b4 ad 54 93 15 15 2d ae 6b e1 c3 c9 20 9c jd..T...-.k... . 0110 70 21 be e6 9d 24 ef b3 e1 e5 53 40 df 87 0f 62 p!...$....S@...b 0120 58 cd cb 71 a7 87 f9 b6 b6 a6 83 4e 5e ec 2b e9 X..q.......N^.+. 0130 72 ba 74 71 27 75 38 cb 05 68 32 d9 12 aa 4d 0f r.tq'u8..h2...M. 0140 ec 21 32 e2 c0 f5 7b 6e 6e 31 .!2...{nn1 Frame 9 (106 bytes on wire, 106 bytes captured) Arrival Time: Aug 15, 2006 13:35:40.881331000 Time delta from previous packet: 0.405709000 seconds Time since reference or first frame: 0.835110000 seconds Frame Number: 9 Packet Length: 106 bytes Capture Length: 106 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa), Dst: 00:05:30:01:80:af (00:05:30:01:80:af) Destination: 00:05:30:01:80:af (00:05:30:01:80:af) Source: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa) Type: IP (0x0800) Frame check sequence: 0x7c2c8e93 [correct] Internet Protocol, Src: 165.227.249.150 (165.227.249.150), Dst: 165.227.249.144 (165.227.249.144) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 88 Identification: 0x0316 (790) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: UDP (0x11) Header checksum: 0xf890 [correct] Good: True Bad : False Source: 165.227.249.150 (165.227.249.150) Destination: 165.227.249.144 (165.227.249.144) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 68 Checksum: 0xcb05 [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0x06F070B44E5CB805 Responder cookie: 0x811534DC4CEEC144 Next payload: Hash (8) Version: 1.0 Exchange type: Quick Mode (32) Flags .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x91BF3510 Length: 60 Encrypted payload (32 bytes) 0000 00 05 30 01 80 af 00 0c 29 96 e1 fa 08 00 45 00 ..0.....).....E. 0010 00 58 03 16 00 00 80 11 f8 90 a5 e3 f9 96 a5 e3 .X.............. 0020 f9 90 01 f4 01 f4 00 44 cb 05 06 f0 70 b4 4e 5c .......D....p.N\ 0030 b8 05 81 15 34 dc 4c ee c1 44 08 10 20 01 91 bf ....4.L..D.. ... 0040 35 10 00 00 00 3c 0b 43 13 7c a8 61 09 35 fe 0d 5....<.C.|.a.5.. 0050 ca 66 be 60 5c 35 c2 a2 f1 c2 fd 2b f0 df 4a 56 .f.`\5.....+..JV 0060 d6 a1 7e b4 ca c2 7c 2c 8e 93 ..~...|,.. Frame 10 (402 bytes on wire, 402 bytes captured) Arrival Time: Aug 15, 2006 13:35:46.913287000 Time delta from previous packet: 6.031956000 seconds Time since reference or first frame: 6.867066000 seconds Frame Number: 10 Packet Length: 402 bytes Capture Length: 402 bytes Protocols in frame: eth:ip:esp:data Ethernet II, Src: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa), Dst: 00:05:30:01:80:af (00:05:30:01:80:af) Destination: 00:05:30:01:80:af (00:05:30:01:80:af) Source: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa) Type: IP (0x0800) Frame check sequence: 0xa1010285 [correct] Internet Protocol, Src: 165.227.249.150 (165.227.249.150), Dst: 165.227.249.144 (165.227.249.144) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 384 Identification: 0x0317 (791) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: ESP (0x32) Header checksum: 0xf746 [correct] Good: True Bad : False Source: 165.227.249.150 (165.227.249.150) Destination: 165.227.249.144 (165.227.249.144) Encapsulating Security Payload SPI: 0x08229201 Sequence: 1 Data (356 bytes) 0000 00 05 30 01 80 af 00 0c 29 96 e1 fa 08 00 45 00 ..0.....).....E. 0010 01 80 03 17 00 00 80 32 f7 46 a5 e3 f9 96 a5 e3 .......2.F...... 0020 f9 90 08 22 92 01 00 00 00 01 96 c4 be 5c 70 0e ...".........\p. 0030 72 80 16 c8 4b 2e c2 d0 2e 8f e3 67 c6 c1 2f 2e r...K......g../. 0040 05 c9 d4 1c 03 4d 5c 01 df cb 42 67 a2 24 0a 66 .....M\...Bg.$.f 0050 26 98 12 96 1b 0d 0f c1 a6 06 7f de 7a a3 2b ed &...........z.+. 0060 9e ba f2 65 a1 83 6b a8 12 e2 06 a8 50 8f b6 6a ...e..k.....P..j 0070 ee 50 9b a8 c2 88 68 dc b4 df c6 6c de 63 4a e8 .P....h....l.cJ. 0080 1a c6 f1 32 04 58 3a 58 a5 0e b1 6d 5e b5 be 19 ...2.X:X...m^... 0090 ac d5 9b 07 f3 e8 df c9 5c e6 56 82 91 01 38 44 ........\.V...8D 00a0 ea e5 25 65 97 08 8b 85 f3 46 d0 b9 a1 d4 c9 c5 ..%e.....F...... 00b0 27 63 f3 4a e2 ef 82 76 44 7c 3d 09 46 95 29 3b 'c.J...vD|=.F.); 00c0 90 75 ad 4a 55 e0 7b bf 7b 16 65 3b c2 e9 99 a6 .u.JU.{.{.e;.... 00d0 a4 53 78 c1 91 a3 58 40 e9 8e 6d 22 e4 16 cf ad .Sx...X@..m".... 00e0 8d 78 65 1f a3 c3 6b a3 15 db 2f e2 50 e6 9a 9e .xe...k.../.P... 00f0 0a b6 c4 05 ad 5b 07 5a 32 0c cc a8 59 fd dd d1 .....[.Z2...Y... 0100 87 a7 be 0d a3 3b ca 45 fa ad 97 3a 6a bb cd e2 .....;.E...:j... 0110 47 c1 21 5c 24 7b 2e 1d 66 c9 46 a3 73 5e f4 1f G.!\${..f.F.s^.. 0120 a0 a9 a9 ed c4 9c 2a 25 8c 27 18 aa 15 31 ce 32 ......*%.'...1.2 0130 43 ec 38 03 43 d7 ff af bf 4c 57 12 8f 9d 06 93 C.8.C....LW..... 0140 34 c3 f2 22 3f ec be 4c bb 08 d0 ac 99 6f 77 c1 4.."?..L.....ow. 0150 37 9f cb 2a a9 9f 86 87 6f 45 e0 da 19 83 32 a5 7..*....oE....2. 0160 5a cb c8 df 28 8f 86 2c be ec e2 8c 7c 33 58 31 Z...(..,....|3X1 0170 ec 70 55 da 2c 36 cc de 8f 74 a1 d4 a6 d1 39 5b .pU.,6...t....9[ 0180 5e 92 f7 f0 7c 6a 30 7a 99 b5 d0 68 bd 93 a1 01 ^...|j0z...h.... 0190 02 85 .. Frame 11 (402 bytes on wire, 402 bytes captured) Arrival Time: Aug 15, 2006 13:35:46.913602000 Time delta from previous packet: 0.000315000 seconds Time since reference or first frame: 6.867381000 seconds Frame Number: 11 Packet Length: 402 bytes Capture Length: 402 bytes Protocols in frame: eth:ip:esp:data Ethernet II, Src: 00:05:30:01:80:af (00:05:30:01:80:af), Dst: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa) Destination: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa) Source: 00:05:30:01:80:af (00:05:30:01:80:af) Type: IP (0x0800) Frame check sequence: 0x4135fbe0 [correct] Internet Protocol, Src: 165.227.249.144 (165.227.249.144), Dst: 165.227.249.150 (165.227.249.150) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 384 Identification: 0x0000 (0) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: ESP (0x32) Header checksum: 0x3a5e [correct] Good: True Bad : False Source: 165.227.249.144 (165.227.249.144) Destination: 165.227.249.150 (165.227.249.150) Encapsulating Security Payload SPI: 0xe7057435 Sequence: 2 Data (356 bytes) 0000 00 0c 29 96 e1 fa 00 05 30 01 80 af 08 00 45 00 ..).....0.....E. 0010 01 80 00 00 00 00 40 32 3a 5e a5 e3 f9 90 a5 e3 ......@2:^...... 0020 f9 96 e7 05 74 35 00 00 00 02 be 8d b9 05 24 9e ....t5........$. 0030 5e a9 c4 55 1c 44 81 ae 35 8d 66 fb db 1c 38 bc ^..U.D..5.f...8. 0040 26 c9 2d 90 a9 a7 40 70 5d fd 05 ac f6 cd 89 3f &.-...@p]......? 0050 1f a2 56 0a 54 60 96 64 c6 16 38 cf 5d 07 0a 08 ..V.T`.d..8.]... 0060 19 f4 d7 92 9e 72 bd ee 26 a8 c7 07 fe df 2d 06 .....r..&.....-. 0070 7d 2c bb e1 44 40 75 5f 00 7e 0b 87 29 0e 5e 3d },..D@u_.~..).^= 0080 c2 84 c7 eb 35 63 ee f6 fe 17 bd ff 7f 34 1b 8a ....5c.......4.. 0090 ec 1e 9e 3a e4 fa 3c 2d 94 c3 9c 4c 21 7b 45 cd ...:..<-...L!{E. 00a0 50 db c1 c9 a5 0a d5 1a ff 81 2e af f6 16 25 04 P.............%. 00b0 ba e6 12 69 96 2a f7 29 1e 08 58 a6 aa ca a3 82 ...i.*.)..X..... 00c0 dc a0 b2 31 97 00 71 fb 30 37 0d 54 ff f0 ae 09 ...1..q.07.T.... 00d0 86 60 05 1e c3 2a 94 bc 9f 33 58 0e 8d 8d 69 9f .`...*...3X...i. 00e0 eb 54 1e b4 fd ff bc e4 24 75 c2 2f 23 8e 40 62 .T......$u./#.@b 00f0 5c 47 09 6e 9b bb 6c 0e 1f 63 ae 65 67 f5 81 a6 \G.n..l..c.eg... 0100 f1 20 be 9d d7 42 d2 29 e0 57 1a 37 24 7d 37 c1 . ...B.).W.7$}7. 0110 e8 1d 25 d9 a8 79 bf 48 6f 8e a9 5c 88 fc 40 6e ..%..y.Ho..\..@n 0120 48 3d 55 06 bf ac e2 a9 89 07 a2 77 c1 b1 b8 ea H=U........w.... 0130 bc e5 ab 23 ef c0 50 19 f2 bc 73 a8 8e 2f f2 28 ...#..P...s../.( 0140 c2 52 b3 11 98 6d 85 8b d1 d3 ab 69 ec c8 b2 7e .R...m.....i...~ 0150 b3 a2 a3 89 03 83 0f 38 07 3c fc ef 63 d7 05 3d .......8.<..c..= 0160 b3 50 54 05 68 43 22 dc fb 19 24 3c 05 54 48 e5 .PT.hC"...$<.TH. 0170 e8 d9 0f 79 05 ca c1 ef 47 4a f2 80 66 f1 d1 25 ...y....GJ..f..% 0180 b7 67 bd 8f 02 ee 8b 04 f5 c7 c7 fd fd 66 41 35 .g...........fA5 0190 fb e0 ..