Frame 1 (226 bytes on wire, 226 bytes captured) Arrival Time: Aug 15, 2006 11:57:25.960529000 Time delta from previous packet: 0.000000000 seconds Time since reference or first frame: 0.000000000 seconds Frame Number: 1 Packet Length: 226 bytes Capture Length: 226 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa), Dst: 00:13:c4:80:d3:aa (00:13:c4:80:d3:aa) Destination: 00:13:c4:80:d3:aa (00:13:c4:80:d3:aa) Source: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa) Type: IP (0x0800) Frame check sequence: 0xc5c9fa1a [correct] Internet Protocol, Src: 165.227.249.150 (165.227.249.150), Dst: 165.227.249.147 (165.227.249.147) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 208 Identification: 0x021a (538) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: UDP (0x11) Header checksum: 0xf911 [correct] Good: True Bad : False Source: 165.227.249.150 (165.227.249.150) Destination: 165.227.249.147 (165.227.249.147) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 188 Checksum: 0x23e6 [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0x170244CA17EA3EDE Responder cookie: 0x0000000000000000 Next payload: Security Association (1) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 180 Security Association payload Next payload: Vendor ID (13) Length: 52 Domain of interpretation: IPSEC (1) Situation: IDENTITY (1) Proposal payload # 1 Next payload: NONE (0) Length: 40 Proposal number: 1 Protocol ID: ISAKMP (1) SPI size: 0 Number of transforms: 1 Transform payload # 1 Next payload: NONE (0) Length: 32 Transform number: 1 Transform ID: KEY_IKE (1) Encryption-Algorithm (1): 3DES-CBC (5) Hash-Algorithm (2): SHA (2) Group-Description (4): Alternate 1024-bit MODP group (2) Authentication-Method (3): PSK (1) Life-Type (11): Seconds (1) Life-Duration (12): Duration-Value (28800) Vendor ID payload Next payload: Vendor ID (13) Length: 20 Vendor ID: unknown vendor ID: 0x4A131C81070358455C5728F20E95452F Vendor ID payload Next payload: Vendor ID (13) Length: 20 Vendor ID: draft-ietf-ipsec-nat-t-ike-03 Vendor ID payload Next payload: Vendor ID (13) Length: 20 Vendor ID: draft-ietf-ipsec-nat-t-ike-02 Vendor ID payload Next payload: Vendor ID (13) Length: 20 Vendor ID: draft-ietf-ipsec-nat-t-ike-00 Vendor ID payload Next payload: NONE (0) Length: 20 Vendor ID: RFC 3706 Detecting Dead IKE Peers (DPD) 0000 00 13 c4 80 d3 aa 00 0c 29 96 e1 fa 08 00 45 00 ........).....E. 0010 00 d0 02 1a 00 00 80 11 f9 11 a5 e3 f9 96 a5 e3 ................ 0020 f9 93 01 f4 01 f4 00 bc 23 e6 17 02 44 ca 17 ea ........#...D... 0030 3e de 00 00 00 00 00 00 00 00 01 10 02 00 00 00 >............... 0040 00 00 00 00 00 b4 0d 00 00 34 00 00 00 01 00 00 .........4...... 0050 00 01 00 00 00 28 01 01 00 01 00 00 00 20 01 01 .....(....... .. 0060 00 00 80 01 00 05 80 02 00 02 80 04 00 02 80 03 ................ 0070 00 01 80 0b 00 01 80 0c 70 80 0d 00 00 14 4a 13 ........p.....J. 0080 1c 81 07 03 58 45 5c 57 28 f2 0e 95 45 2f 0d 00 ....XE\W(...E/.. 0090 00 14 7d 94 19 a6 53 10 ca 6f 2c 17 9d 92 15 52 ..}...S..o,....R 00a0 9d 56 0d 00 00 14 90 cb 80 91 3e bb 69 6e 08 63 .V........>.in.c 00b0 81 b5 ec 42 7b 1f 0d 00 00 14 44 85 15 2d 18 b6 ...B{.....D..-.. 00c0 bb cd 0b e8 a8 46 95 79 dd cc 00 00 00 14 af ca .....F.y........ 00d0 d7 13 68 a1 f1 c9 6b 86 96 fc 77 57 01 00 c5 c9 ..h...k...wW.... 00e0 fa 1a .. Frame 2 (150 bytes on wire, 150 bytes captured) Arrival Time: Aug 15, 2006 11:57:25.961479000 Time delta from previous packet: 0.000950000 seconds Time since reference or first frame: 0.000950000 seconds Frame Number: 2 Packet Length: 150 bytes Capture Length: 150 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:13:c4:80:d3:aa (00:13:c4:80:d3:aa), Dst: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa) Destination: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa) Source: 00:13:c4:80:d3:aa (00:13:c4:80:d3:aa) Type: IP (0x0800) Frame check sequence: 0x0409a8ee [correct] Internet Protocol, Src: 165.227.249.147 (165.227.249.147), Dst: 165.227.249.150 (165.227.249.150) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 132 Identification: 0x4de1 (19937) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 255 Protocol: UDP (0x11) Header checksum: 0x2e96 [correct] Good: True Bad : False Source: 165.227.249.147 (165.227.249.147) Destination: 165.227.249.150 (165.227.249.150) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 112 Checksum: 0xacff [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0x170244CA17EA3EDE Responder cookie: 0xB847C64F87ECFAE9 Next payload: Security Association (1) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 104 Security Association payload Next payload: Vendor ID (13) Length: 52 Domain of interpretation: IPSEC (1) Situation: IDENTITY (1) Proposal payload # 1 Next payload: NONE (0) Length: 40 Proposal number: 1 Protocol ID: ISAKMP (1) SPI size: 0 Number of transforms: 1 Transform payload # 1 Next payload: NONE (0) Length: 32 Transform number: 1 Transform ID: KEY_IKE (1) Encryption-Algorithm (1): 3DES-CBC (5) Hash-Algorithm (2): SHA (2) Group-Description (4): Alternate 1024-bit MODP group (2) Authentication-Method (3): PSK (1) Life-Type (11): Seconds (1) Life-Duration (12): Duration-Value (28800) Vendor ID payload Next payload: NONE (0) Length: 24 Vendor ID: Microsoft L2TP/IPSec VPN Client 0000 00 0c 29 96 e1 fa 00 13 c4 80 d3 aa 08 00 45 00 ..)...........E. 0010 00 84 4d e1 00 00 ff 11 2e 96 a5 e3 f9 93 a5 e3 ..M............. 0020 f9 96 01 f4 01 f4 00 70 ac ff 17 02 44 ca 17 ea .......p....D... 0030 3e de b8 47 c6 4f 87 ec fa e9 01 10 02 00 00 00 >..G.O.......... 0040 00 00 00 00 00 68 0d 00 00 34 00 00 00 01 00 00 .....h...4...... 0050 00 01 00 00 00 28 01 01 00 01 00 00 00 20 01 01 .....(....... .. 0060 00 00 80 01 00 05 80 02 00 02 80 04 00 02 80 03 ................ 0070 00 01 80 0b 00 01 80 0c 70 80 00 00 00 18 40 48 ........p.....@H 0080 b7 d5 6e bc e8 85 25 e7 de 7f 00 d6 c2 d3 c0 00 ..n...%......... 0090 00 00 04 09 a8 ee ...... Frame 3 (226 bytes on wire, 226 bytes captured) Arrival Time: Aug 15, 2006 11:57:26.080062000 Time delta from previous packet: 0.118583000 seconds Time since reference or first frame: 0.119533000 seconds Frame Number: 3 Packet Length: 226 bytes Capture Length: 226 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa), Dst: 00:13:c4:80:d3:aa (00:13:c4:80:d3:aa) Destination: 00:13:c4:80:d3:aa (00:13:c4:80:d3:aa) Source: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa) Type: IP (0x0800) Frame check sequence: 0x7ce440b3 [correct] Internet Protocol, Src: 165.227.249.150 (165.227.249.150), Dst: 165.227.249.147 (165.227.249.147) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 208 Identification: 0x021b (539) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: UDP (0x11) Header checksum: 0xf910 [correct] Good: True Bad : False Source: 165.227.249.150 (165.227.249.150) Destination: 165.227.249.147 (165.227.249.147) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 188 Checksum: 0x72c4 [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0x170244CA17EA3EDE Responder cookie: 0xB847C64F87ECFAE9 Next payload: Key Exchange (4) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 180 Key Exchange payload Next payload: Nonce (10) Length: 132 Key Exchange Data Nonce payload Next payload: NONE (0) Length: 20 Nonce Data 0000 00 13 c4 80 d3 aa 00 0c 29 96 e1 fa 08 00 45 00 ........).....E. 0010 00 d0 02 1b 00 00 80 11 f9 10 a5 e3 f9 96 a5 e3 ................ 0020 f9 93 01 f4 01 f4 00 bc 72 c4 17 02 44 ca 17 ea ........r...D... 0030 3e de b8 47 c6 4f 87 ec fa e9 04 10 02 00 00 00 >..G.O.......... 0040 00 00 00 00 00 b4 0a 00 00 84 82 50 49 e0 34 ad ...........PI.4. 0050 67 94 25 c7 26 04 0b 82 2a f9 ff 5a ae c3 3b 6b g.%.&...*..Z..;k 0060 43 d5 32 dc ee 32 e5 6a b6 b4 6e e6 f3 1e f2 b8 C.2..2.j..n..... 0070 b3 91 ab 47 3e 58 11 97 96 16 37 0c 64 fc 82 42 ...G>X....7.d..B 0080 b1 41 9c 29 c2 fc d6 46 fa 6f c1 5c e2 ae 2a 67 .A.)...F.o.\..*g 0090 80 04 2d 3e 3a 0a 8f 25 ce 14 22 40 c4 81 35 69 ..->:..%.."@..5i 00a0 2e 07 4a 84 32 a3 e3 27 b7 1b 9a 68 1b 3d f7 b8 ..J.2..'...h.=.. 00b0 f3 24 80 0b f8 77 6b bd cf fe 04 08 c5 10 20 79 .$...wk....... y 00c0 fc 23 2e 20 b1 12 ec fe d4 e2 00 00 00 14 25 2f .#. ..........%/ 00d0 21 74 d1 eb b5 e1 da b7 ad ad d9 d4 94 5a 7c e4 !t...........Z|. 00e0 40 b3 @. Frame 4 (302 bytes on wire, 302 bytes captured) Arrival Time: Aug 15, 2006 11:57:26.081623000 Time delta from previous packet: 0.001561000 seconds Time since reference or first frame: 0.121094000 seconds Frame Number: 4 Packet Length: 302 bytes Capture Length: 302 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:13:c4:80:d3:aa (00:13:c4:80:d3:aa), Dst: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa) Destination: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa) Source: 00:13:c4:80:d3:aa (00:13:c4:80:d3:aa) Type: IP (0x0800) Frame check sequence: 0x632856c9 [correct] Internet Protocol, Src: 165.227.249.147 (165.227.249.147), Dst: 165.227.249.150 (165.227.249.150) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 284 Identification: 0x0878 (2168) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 255 Protocol: UDP (0x11) Header checksum: 0x7367 [correct] Good: True Bad : False Source: 165.227.249.147 (165.227.249.147) Destination: 165.227.249.150 (165.227.249.150) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 264 Checksum: 0xe55c [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0x170244CA17EA3EDE Responder cookie: 0xB847C64F87ECFAE9 Next payload: Key Exchange (4) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 256 Key Exchange payload Next payload: Nonce (10) Length: 132 Key Exchange Data Nonce payload Next payload: Vendor ID (13) Length: 24 Nonce Data Vendor ID payload Next payload: Vendor ID (13) Length: 20 Vendor ID: unknown vendor ID: 0x12F5F28C457168A9702D9FE274CC0100 Vendor ID payload Next payload: Vendor ID (13) Length: 12 Vendor ID: draft-beaulieu-ike-xauth-02.txt Vendor ID payload Next payload: Vendor ID (13) Length: 20 Vendor ID: unknown vendor ID: 0x4D80615287EDFAE9A25B0B03AD69FB55 Vendor ID payload Next payload: NONE (0) Length: 20 Vendor ID: unknown vendor ID: 0x1F07F70EAA6514D3B0FA96542A500100 0000 00 0c 29 96 e1 fa 00 13 c4 80 d3 aa 08 00 45 00 ..)...........E. 0010 01 1c 08 78 00 00 ff 11 73 67 a5 e3 f9 93 a5 e3 ...x....sg...... 0020 f9 96 01 f4 01 f4 01 08 e5 5c 17 02 44 ca 17 ea .........\..D... 0030 3e de b8 47 c6 4f 87 ec fa e9 04 10 02 00 00 00 >..G.O.......... 0040 00 00 00 00 01 00 0a 00 00 84 df 2a 8d 7b 91 e2 ...........*.{.. 0050 67 b5 9a b6 17 d0 49 0c 3f 1c b4 6d 0a 71 24 a0 g.....I.?..m.q$. 0060 a4 7c 95 cd 46 c2 ef ce 35 c8 f4 60 4f 4a c7 c4 .|..F...5..`OJ.. 0070 bd 70 9e 08 25 76 95 86 73 83 a7 fc 9e 21 72 a3 .p..%v..s....!r. 0080 b1 71 c0 79 32 4d 76 38 9f f3 6f 84 71 00 33 f0 .q.y2Mv8..o.q.3. 0090 01 ce 62 6d 36 6b 94 8c 3c 29 91 41 72 11 53 a6 ..bm6k..<).Ar.S. 00a0 92 86 d9 9d 64 e7 8a 92 4f 43 5c e0 d8 fb 3b 51 ....d...OC\...;Q 00b0 25 41 a3 d8 1a 01 bf 10 ff 1f 7c 32 e6 5d 12 50 %A........|2.].P 00c0 7b b9 c6 54 5e 21 09 72 ec 60 0d 00 00 18 39 42 {..T^!.r.`....9B 00d0 a9 a9 ca f7 5c 06 bb 31 eb ff ff cf 9f e8 4c 39 ....\..1......L9 00e0 9c 57 0d 00 00 14 12 f5 f2 8c 45 71 68 a9 70 2d .W........Eqh.p- 00f0 9f e2 74 cc 01 00 0d 00 00 0c 09 00 26 89 df d6 ..t.........&... 0100 b7 12 0d 00 00 14 4d 80 61 52 87 ed fa e9 a2 5b ......M.aR.....[ 0110 0b 03 ad 69 fb 55 00 00 00 14 1f 07 f7 0e aa 65 ...i.U.........e 0120 14 d3 b0 fa 96 54 2a 50 01 00 63 28 56 c9 .....T*P..c(V. Frame 5 (146 bytes on wire, 146 bytes captured) Arrival Time: Aug 15, 2006 11:57:26.288422000 Time delta from previous packet: 0.206799000 seconds Time since reference or first frame: 0.327893000 seconds Frame Number: 5 Packet Length: 146 bytes Capture Length: 146 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa), Dst: 00:13:c4:80:d3:aa (00:13:c4:80:d3:aa) Destination: 00:13:c4:80:d3:aa (00:13:c4:80:d3:aa) Source: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa) Type: IP (0x0800) Frame check sequence: 0xe4035924 [correct] Internet Protocol, Src: 165.227.249.150 (165.227.249.150), Dst: 165.227.249.147 (165.227.249.147) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 128 Identification: 0x021c (540) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: UDP (0x11) Header checksum: 0xf95f [correct] Good: True Bad : False Source: 165.227.249.150 (165.227.249.150) Destination: 165.227.249.147 (165.227.249.147) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 108 Checksum: 0x23d8 [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0x170244CA17EA3EDE Responder cookie: 0xB847C64F87ECFAE9 Next payload: Identification (5) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 100 Encrypted payload (72 bytes) 0000 00 13 c4 80 d3 aa 00 0c 29 96 e1 fa 08 00 45 00 ........).....E. 0010 00 80 02 1c 00 00 80 11 f9 5f a5 e3 f9 96 a5 e3 ........._...... 0020 f9 93 01 f4 01 f4 00 6c 23 d8 17 02 44 ca 17 ea .......l#...D... 0030 3e de b8 47 c6 4f 87 ec fa e9 05 10 02 01 00 00 >..G.O.......... 0040 00 00 00 00 00 64 77 1d d4 9d be bd 68 32 7c 78 .....dw.....h2|x 0050 da af 7d e6 c0 9b 44 8c 7a 8d 8e fa 4f d1 e2 fe ..}...D.z...O... 0060 7a e5 5d 21 ec c7 17 7d f9 ca 89 15 73 66 35 06 z.]!...}....sf5. 0070 bb 8e bd 75 88 de 2e 46 c4 9f 07 91 dc 76 a9 61 ...u...F.....v.a 0080 e3 7f 63 73 ba ce 99 33 a0 44 1e 9d 70 0f e4 03 ..cs...3.D..p... 0090 59 24 Y$ Frame 6 (130 bytes on wire, 130 bytes captured) Arrival Time: Aug 15, 2006 11:57:26.289366000 Time delta from previous packet: 0.000944000 seconds Time since reference or first frame: 0.328837000 seconds Frame Number: 6 Packet Length: 130 bytes Capture Length: 130 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:13:c4:80:d3:aa (00:13:c4:80:d3:aa), Dst: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa) Destination: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa) Source: 00:13:c4:80:d3:aa (00:13:c4:80:d3:aa) Type: IP (0x0800) Frame check sequence: 0x85d29b64 [correct] Internet Protocol, Src: 165.227.249.147 (165.227.249.147), Dst: 165.227.249.150 (165.227.249.150) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 112 Identification: 0x459c (17820) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 255 Protocol: UDP (0x11) Header checksum: 0x36ef [correct] Good: True Bad : False Source: 165.227.249.147 (165.227.249.147) Destination: 165.227.249.150 (165.227.249.150) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 92 Checksum: 0x0e7b [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0x170244CA17EA3EDE Responder cookie: 0xB847C64F87ECFAE9 Next payload: Identification (5) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 84 Encrypted payload (56 bytes) 0000 00 0c 29 96 e1 fa 00 13 c4 80 d3 aa 08 00 45 00 ..)...........E. 0010 00 70 45 9c 00 00 ff 11 36 ef a5 e3 f9 93 a5 e3 .pE.....6....... 0020 f9 96 01 f4 01 f4 00 5c 0e 7b 17 02 44 ca 17 ea .......\.{..D... 0030 3e de b8 47 c6 4f 87 ec fa e9 05 10 02 01 00 00 >..G.O.......... 0040 00 00 00 00 00 54 d8 fd 55 c7 68 15 2c 0e ba 2b .....T..U.h.,..+ 0050 0d f2 94 f5 28 fa 54 c9 cd cd ef ec 27 8b 00 09 ....(.T.....'... 0060 5d bf 87 33 1a 4a c5 16 e4 bd 23 f6 a3 f2 0b 8c ]..3.J....#..... 0070 f1 66 6a 1f e8 41 b8 77 68 aa b1 2c dc cd 85 d2 .fj..A.wh..,.... 0080 9b 64 .d Frame 7 (338 bytes on wire, 338 bytes captured) Arrival Time: Aug 15, 2006 11:57:26.449929000 Time delta from previous packet: 0.160563000 seconds Time since reference or first frame: 0.489400000 seconds Frame Number: 7 Packet Length: 338 bytes Capture Length: 338 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa), Dst: 00:13:c4:80:d3:aa (00:13:c4:80:d3:aa) Destination: 00:13:c4:80:d3:aa (00:13:c4:80:d3:aa) Source: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa) Type: IP (0x0800) Frame check sequence: 0xeaef2a45 [correct] Internet Protocol, Src: 165.227.249.150 (165.227.249.150), Dst: 165.227.249.147 (165.227.249.147) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 320 Identification: 0x021d (541) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: UDP (0x11) Header checksum: 0xf89e [correct] Good: True Bad : False Source: 165.227.249.150 (165.227.249.150) Destination: 165.227.249.147 (165.227.249.147) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 300 Checksum: 0x59bb [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0x170244CA17EA3EDE Responder cookie: 0xB847C64F87ECFAE9 Next payload: Hash (8) Version: 1.0 Exchange type: Quick Mode (32) Flags .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x7B167BF1 Length: 292 Encrypted payload (264 bytes) 0000 00 13 c4 80 d3 aa 00 0c 29 96 e1 fa 08 00 45 00 ........).....E. 0010 01 40 02 1d 00 00 80 11 f8 9e a5 e3 f9 96 a5 e3 .@.............. 0020 f9 93 01 f4 01 f4 01 2c 59 bb 17 02 44 ca 17 ea .......,Y...D... 0030 3e de b8 47 c6 4f 87 ec fa e9 08 10 20 01 7b 16 >..G.O...... .{. 0040 7b f1 00 00 01 24 eb e1 2e dc f6 f4 9b 74 33 bc {....$.......t3. 0050 00 7e 66 52 3b ba f4 70 5a 5f 52 d4 02 04 3c 47 .~fR;..pZ_R.....G.O...... .{. 0040 7b f1 00 00 01 24 36 de cd 71 e2 dd 4e 53 d8 fd {....$6..q..NS.. 0050 7f 08 7a 0e 4d 9f e3 fd 6f 16 66 88 4a bf 97 a8 ..z.M...o.f.J... 0060 38 a3 93 c1 f3 0f 3b ec 9e 41 09 0f f9 fc 61 ac 8.....;..A....a. 0070 c2 3e 89 87 cc 85 01 82 c2 4f c8 6c 43 c7 70 f7 .>.......O.lC.p. 0080 46 76 d9 71 3a ea 29 52 df 6f e9 39 b6 43 c2 f1 Fv.q:.)R.o.9.C.. 0090 82 6d a1 82 a1 9d 56 48 1a 2c 91 26 2f 4d 94 c0 .m....VH.,.&/M.. 00a0 67 dd da bf fc 22 a8 14 57 c4 fb cb dc 8b ab 79 g...."..W......y 00b0 eb 2b 75 47 74 ac 56 9c 68 b1 da a4 9e 59 53 64 .+uGt.V.h....YSd 00c0 a9 75 6c 3a 89 34 24 bc f5 6c 79 34 5b 3d c6 15 .ul:.4$..ly4[=.. 00d0 78 6f 98 5e 05 58 d2 02 76 02 a6 69 52 fa 75 50 xo.^.X..v..iR.uP 00e0 5c f3 59 f2 e5 dc 9a b4 48 3a 61 2e 97 8a ba d1 \.Y.....H:a..... 00f0 f9 e1 d3 37 4f e4 da ac 95 13 fd 5e e0 27 4d ae ...7O......^.'M. 0100 e8 b7 b1 8b f8 6a 91 3f db 01 f7 b7 4f 4e d0 5f .....j.?....ON._ 0110 21 f4 ee 3e e2 dd 75 07 99 af ee f9 03 84 13 38 !..>..u........8 0120 17 04 ca d7 2b af 1f 7a db d8 20 9e 51 a1 09 c2 ....+..z.. .Q... 0130 3c 89 3b 54 84 e0 1b 33 7a 10 99 3c 16 c3 7e e7 <.;T...3z..<..~. 0140 4f 24 2d b1 5e a1 05 83 00 38 62 9b 30 e1 c9 f6 O$-.^....8b.0... 0150 01 78 .x Frame 9 (106 bytes on wire, 106 bytes captured) Arrival Time: Aug 15, 2006 11:57:26.918368000 Time delta from previous packet: 0.465415000 seconds Time since reference or first frame: 0.957839000 seconds Frame Number: 9 Packet Length: 106 bytes Capture Length: 106 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa), Dst: 00:13:c4:80:d3:aa (00:13:c4:80:d3:aa) Destination: 00:13:c4:80:d3:aa (00:13:c4:80:d3:aa) Source: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa) Type: IP (0x0800) Frame check sequence: 0x13ccde92 [correct] Internet Protocol, Src: 165.227.249.150 (165.227.249.150), Dst: 165.227.249.147 (165.227.249.147) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 88 Identification: 0x021e (542) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: UDP (0x11) Header checksum: 0xf985 [correct] Good: True Bad : False Source: 165.227.249.150 (165.227.249.150) Destination: 165.227.249.147 (165.227.249.147) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 68 Checksum: 0xd847 [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0x170244CA17EA3EDE Responder cookie: 0xB847C64F87ECFAE9 Next payload: Hash (8) Version: 1.0 Exchange type: Quick Mode (32) Flags .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x7B167BF1 Length: 60 Encrypted payload (32 bytes) 0000 00 13 c4 80 d3 aa 00 0c 29 96 e1 fa 08 00 45 00 ........).....E. 0010 00 58 02 1e 00 00 80 11 f9 85 a5 e3 f9 96 a5 e3 .X.............. 0020 f9 93 01 f4 01 f4 00 44 d8 47 17 02 44 ca 17 ea .......D.G..D... 0030 3e de b8 47 c6 4f 87 ec fa e9 08 10 20 01 7b 16 >..G.O...... .{. 0040 7b f1 00 00 00 3c af 52 01 37 05 ee 8e 15 e0 f2 {....<.R.7...... 0050 05 41 47 67 fb 84 0b 82 75 f2 c7 9e ba 85 cb 23 .AGg....u......# 0060 7a 06 86 2a d4 51 13 cc de 92 z..*.Q.... Frame 10 (402 bytes on wire, 402 bytes captured) Arrival Time: Aug 15, 2006 11:57:31.480622000 Time delta from previous packet: 4.562254000 seconds Time since reference or first frame: 5.520093000 seconds Frame Number: 10 Packet Length: 402 bytes Capture Length: 402 bytes Protocols in frame: eth:ip:esp:data Ethernet II, Src: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa), Dst: 00:13:c4:80:d3:aa (00:13:c4:80:d3:aa) Destination: 00:13:c4:80:d3:aa (00:13:c4:80:d3:aa) Source: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa) Type: IP (0x0800) Frame check sequence: 0x6d2e1de0 [correct] Internet Protocol, Src: 165.227.249.150 (165.227.249.150), Dst: 165.227.249.147 (165.227.249.147) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 384 Identification: 0x021f (543) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: ESP (0x32) Header checksum: 0xf83b [correct] Good: True Bad : False Source: 165.227.249.150 (165.227.249.150) Destination: 165.227.249.147 (165.227.249.147) Encapsulating Security Payload SPI: 0x8472bbb1 Sequence: 1 Data (356 bytes) 0000 00 13 c4 80 d3 aa 00 0c 29 96 e1 fa 08 00 45 00 ........).....E. 0010 01 80 02 1f 00 00 80 32 f8 3b a5 e3 f9 96 a5 e3 .......2.;...... 0020 f9 93 84 72 bb b1 00 00 00 01 30 34 5a 7d 2c 7a ...r......04Z},z 0030 e9 07 4c a1 e1 ae a3 ea da 00 ef 54 27 51 15 fb ..L........T'Q.. 0040 e1 82 f9 c1 00 7d 33 9b bf b7 00 62 b5 4a e2 b2 .....}3....b.J.. 0050 3a dd 1b 30 9d 44 bb 81 c8 73 79 fc a3 96 b4 26 :..0.D...sy....& 0060 d4 1c 6e 70 cd f3 dd b4 3b fe 8c 7c da 3c 44 67 ..np....;..|...6. 0150 50 00 3c c2 3b 4b 4b 53 b9 60 9d 4e 3e 7c c7 5d P.<.;KKS.`.N>|.] 0160 86 52 a4 3e c1 a4 9b 29 91 89 46 46 1a bc 5f 5e .R.>...)..FF.._^ 0170 ec 40 92 09 24 ba 1a 7f ca 32 8d b1 34 ba 9e f6 .@..$....2..4... 0180 5c 7a 08 33 6a ed 13 e6 bc 17 4d cc 40 cf 6d 2e \z.3j.....M.@.m. 0190 1d e0 .. Frame 11 (402 bytes on wire, 402 bytes captured) Arrival Time: Aug 15, 2006 11:57:31.482098000 Time delta from previous packet: 0.001476000 seconds Time since reference or first frame: 5.521569000 seconds Frame Number: 11 Packet Length: 402 bytes Capture Length: 402 bytes Protocols in frame: eth:ip:esp:data Ethernet II, Src: 00:13:c4:80:d3:aa (00:13:c4:80:d3:aa), Dst: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa) Destination: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa) Source: 00:13:c4:80:d3:aa (00:13:c4:80:d3:aa) Type: IP (0x0800) Frame check sequence: 0x5c6e8a45 [correct] Internet Protocol, Src: 165.227.249.147 (165.227.249.147), Dst: 165.227.249.150 (165.227.249.150) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 384 Identification: 0x8d5e (36190) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: ESP (0x32) Header checksum: 0xacfc [correct] Good: True Bad : False Source: 165.227.249.147 (165.227.249.147) Destination: 165.227.249.150 (165.227.249.150) Encapsulating Security Payload SPI: 0x4a542810 Sequence: 1 Data (356 bytes) 0000 00 0c 29 96 e1 fa 00 13 c4 80 d3 aa 08 00 45 00 ..)...........E. 0010 01 80 8d 5e 00 00 40 32 ac fc a5 e3 f9 93 a5 e3 ...^..@2........ 0020 f9 96 4a 54 28 10 00 00 00 01 a1 39 b1 77 1d 39 ..JT(......9.w.9 0030 c0 8a 06 23 16 d9 50 50 e1 61 69 8f 0e 3d 92 76 ...#..PP.ai..=.v 0040 d2 8f be 66 a8 9f 7c 33 d8 12 06 57 04 48 f1 68 ...f..|3...W.H.h 0050 f8 d3 84 30 b4 fd f1 87 7b b6 42 2d e6 2b 86 aa ...0....{.B-.+.. 0060 8b f2 bc 4a 4f 85 f3 4c 21 32 10 d1 5a 2d 70 e8 ...JO..L!2..Z-p. 0070 88 8a 02 5d 69 95 13 85 fd 49 b5 d2 bc 22 32 49 ...]i....I..."2I 0080 b1 17 29 3f 84 4b 07 6d 9d 54 1d 1f bb 41 19 0b ..)?.K.m.T...A.. 0090 4d ad 49 45 7a c4 fa 7d fa 0a 27 c1 4c 7d 14 9d M.IEz..}..'.L}.. 00a0 52 2c 27 71 9f 62 a6 81 b1 30 18 c8 54 8c 10 b7 R,'q.b...0..T... 00b0 d5 d3 3e b5 e9 83 99 c4 93 87 6e 27 eb bc 1b 00 ..>.......n'.... 00c0 e5 09 a8 67 7c 57 4f 1f 90 1d 70 92 6c 68 45 90 ...g|WO...p.lhE. 00d0 04 37 a4 87 10 10 8c 1c 5f 5e ad e1 f4 ee 30 3c .7......_^....0< 00e0 69 13 01 d1 7e 11 2b 72 ac 35 fe 9a 94 2d 11 89 i...~.+r.5...-.. 00f0 74 42 91 47 de 84 51 4a bd bf ee 8e fb 76 ea 8f tB.G..QJ.....v.. 0100 46 8e 4b 87 d5 41 e8 d4 32 4c 81 68 15 a0 69 9f F.K..A..2L.h..i. 0110 79 63 ec cb bc 32 47 48 0c 31 84 e9 bc a1 b0 b1 yc...2GH.1...... 0120 65 6e d2 0a 76 c8 8a 13 d7 c0 bd df 87 f9 3d c0 en..v.........=. 0130 8c 74 1d 1d 1d 52 e2 23 9e 1e bc e6 7f 3d 90 44 .t...R.#.....=.D 0140 51 e8 77 a8 49 b5 55 3d 7b 85 36 1a 13 79 d4 90 Q.w.I.U={.6..y.. 0150 7a 64 01 97 00 18 5d 49 50 61 3e 32 96 66 fc 21 zd....]IPa>2.f.! 0160 b7 24 0d c9 5c 53 77 76 18 97 98 ad 2c 28 0a 40 .$..\Swv....,(.@ 0170 e1 64 02 36 97 81 fb 1c 33 0b 7b 15 43 21 ef c5 .d.6....3.{.C!.. 0180 74 93 20 1d 70 b3 02 e9 b4 db 21 ec 6c f1 5c 6e t. .p.....!.l.\n 0190 8a 45 .E