Frame 1 (226 bytes on wire, 226 bytes captured) Arrival Time: Aug 15, 2006 11:12:15.832444000 Time delta from previous packet: 0.000000000 seconds Time since reference or first frame: 0.000000000 seconds Frame Number: 1 Packet Length: 226 bytes Capture Length: 226 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa), Dst: 00:0b:0b:00:00:01 (00:0b:0b:00:00:01) Destination: 00:0b:0b:00:00:01 (00:0b:0b:00:00:01) Source: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa) Type: IP (0x0800) Frame check sequence: 0x41994ca2 [correct] Internet Protocol, Src: 165.227.249.150 (165.227.249.150), Dst: 165.227.249.148 (165.227.249.148) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 208 Identification: 0x01b4 (436) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: UDP (0x11) Header checksum: 0xf976 [correct] Good: True Bad : False Source: 165.227.249.150 (165.227.249.150) Destination: 165.227.249.148 (165.227.249.148) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 188 Checksum: 0x629f [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0x3B909DFBB2DFE76E Responder cookie: 0x0000000000000000 Next payload: Security Association (1) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 180 Security Association payload Next payload: Vendor ID (13) Length: 52 Domain of interpretation: IPSEC (1) Situation: IDENTITY (1) Proposal payload # 1 Next payload: NONE (0) Length: 40 Proposal number: 1 Protocol ID: ISAKMP (1) SPI size: 0 Number of transforms: 1 Transform payload # 1 Next payload: NONE (0) Length: 32 Transform number: 1 Transform ID: KEY_IKE (1) Encryption-Algorithm (1): 3DES-CBC (5) Hash-Algorithm (2): SHA (2) Group-Description (4): Alternate 1024-bit MODP group (2) Authentication-Method (3): PSK (1) Life-Type (11): Seconds (1) Life-Duration (12): Duration-Value (28800) Vendor ID payload Next payload: Vendor ID (13) Length: 20 Vendor ID: unknown vendor ID: 0x4A131C81070358455C5728F20E95452F Vendor ID payload Next payload: Vendor ID (13) Length: 20 Vendor ID: draft-ietf-ipsec-nat-t-ike-03 Vendor ID payload Next payload: Vendor ID (13) Length: 20 Vendor ID: draft-ietf-ipsec-nat-t-ike-02 Vendor ID payload Next payload: Vendor ID (13) Length: 20 Vendor ID: draft-ietf-ipsec-nat-t-ike-00 Vendor ID payload Next payload: NONE (0) Length: 20 Vendor ID: RFC 3706 Detecting Dead IKE Peers (DPD) 0000 00 0b 0b 00 00 01 00 0c 29 96 e1 fa 08 00 45 00 ........).....E. 0010 00 d0 01 b4 00 00 80 11 f9 76 a5 e3 f9 96 a5 e3 .........v...... 0020 f9 94 01 f4 01 f4 00 bc 62 9f 3b 90 9d fb b2 df ........b.;..... 0030 e7 6e 00 00 00 00 00 00 00 00 01 10 02 00 00 00 .n.............. 0040 00 00 00 00 00 b4 0d 00 00 34 00 00 00 01 00 00 .........4...... 0050 00 01 00 00 00 28 01 01 00 01 00 00 00 20 01 01 .....(....... .. 0060 00 00 80 01 00 05 80 02 00 02 80 04 00 02 80 03 ................ 0070 00 01 80 0b 00 01 80 0c 70 80 0d 00 00 14 4a 13 ........p.....J. 0080 1c 81 07 03 58 45 5c 57 28 f2 0e 95 45 2f 0d 00 ....XE\W(...E/.. 0090 00 14 7d 94 19 a6 53 10 ca 6f 2c 17 9d 92 15 52 ..}...S..o,....R 00a0 9d 56 0d 00 00 14 90 cb 80 91 3e bb 69 6e 08 63 .V........>.in.c 00b0 81 b5 ec 42 7b 1f 0d 00 00 14 44 85 15 2d 18 b6 ...B{.....D..-.. 00c0 bb cd 0b e8 a8 46 95 79 dd cc 00 00 00 14 af ca .....F.y........ 00d0 d7 13 68 a1 f1 c9 6b 86 96 fc 77 57 01 00 41 99 ..h...k...wW..A. 00e0 4c a2 L. Frame 2 (130 bytes on wire, 130 bytes captured) Arrival Time: Aug 15, 2006 11:12:15.849067000 Time delta from previous packet: 0.016623000 seconds Time since reference or first frame: 0.016623000 seconds Frame Number: 2 Packet Length: 130 bytes Capture Length: 130 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:0b:0b:00:00:01 (00:0b:0b:00:00:01), Dst: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa) Destination: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa) Source: 00:0b:0b:00:00:01 (00:0b:0b:00:00:01) Type: IP (0x0800) Frame check sequence: 0x09b18dce [correct] Internet Protocol, Src: 165.227.249.148 (165.227.249.148), Dst: 165.227.249.150 (165.227.249.150) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 112 Identification: 0x0002 (2) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 255 Protocol: UDP (0x11) Header checksum: 0x7c88 [correct] Good: True Bad : False Source: 165.227.249.148 (165.227.249.148) Destination: 165.227.249.150 (165.227.249.150) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 92 Checksum: 0x625e [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0x3B909DFBB2DFE76E Responder cookie: 0xF7CE6EF3C4D5C3E6 Next payload: Security Association (1) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 84 Security Association payload Next payload: NONE (0) Length: 56 Domain of interpretation: IPSEC (1) Situation: IDENTITY (1) Proposal payload # 1 Next payload: NONE (0) Length: 44 Proposal number: 1 Protocol ID: ISAKMP (1) SPI size: 0 Number of transforms: 1 Transform payload # 1 Next payload: NONE (0) Length: 36 Transform number: 1 Transform ID: KEY_IKE (1) Encryption-Algorithm (1): 3DES-CBC (5) Hash-Algorithm (2): SHA (2) Authentication-Method (3): PSK (1) Group-Description (4): Alternate 1024-bit MODP group (2) Life-Type (11): Seconds (1) Life-Duration (12): Duration-Value (28800) 0000 00 0c 29 96 e1 fa 00 0b 0b 00 00 01 08 00 45 00 ..)...........E. 0010 00 70 00 02 00 00 ff 11 7c 88 a5 e3 f9 94 a5 e3 .p......|....... 0020 f9 96 01 f4 01 f4 00 5c 62 5e 3b 90 9d fb b2 df .......\b^;..... 0030 e7 6e f7 ce 6e f3 c4 d5 c3 e6 01 10 02 00 00 00 .n..n........... 0040 00 00 00 00 00 54 00 00 00 38 00 00 00 01 00 00 .....T...8...... 0050 00 01 00 00 00 2c 01 01 00 01 00 00 00 24 01 01 .....,.......$.. 0060 00 00 80 01 00 05 80 02 00 02 80 03 00 01 80 04 ................ 0070 00 02 80 0b 00 01 00 0c 00 04 00 00 70 80 09 b1 ............p... 0080 8d ce .. Frame 3 (226 bytes on wire, 226 bytes captured) Arrival Time: Aug 15, 2006 11:12:15.917860000 Time delta from previous packet: 0.068793000 seconds Time since reference or first frame: 0.085416000 seconds Frame Number: 3 Packet Length: 226 bytes Capture Length: 226 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa), Dst: 00:0b:0b:00:00:01 (00:0b:0b:00:00:01) Destination: 00:0b:0b:00:00:01 (00:0b:0b:00:00:01) Source: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa) Type: IP (0x0800) Frame check sequence: 0x10131c0c [correct] Internet Protocol, Src: 165.227.249.150 (165.227.249.150), Dst: 165.227.249.148 (165.227.249.148) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 208 Identification: 0x01b5 (437) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: UDP (0x11) Header checksum: 0xf975 [correct] Good: True Bad : False Source: 165.227.249.150 (165.227.249.150) Destination: 165.227.249.148 (165.227.249.148) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 188 Checksum: 0x2f0a [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0x3B909DFBB2DFE76E Responder cookie: 0xF7CE6EF3C4D5C3E6 Next payload: Key Exchange (4) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 180 Key Exchange payload Next payload: Nonce (10) Length: 132 Key Exchange Data Nonce payload Next payload: NONE (0) Length: 20 Nonce Data 0000 00 0b 0b 00 00 01 00 0c 29 96 e1 fa 08 00 45 00 ........).....E. 0010 00 d0 01 b5 00 00 80 11 f9 75 a5 e3 f9 96 a5 e3 .........u...... 0020 f9 94 01 f4 01 f4 00 bc 2f 0a 3b 90 9d fb b2 df ......../.;..... 0030 e7 6e f7 ce 6e f3 c4 d5 c3 e6 04 10 02 00 00 00 .n..n........... 0040 00 00 00 00 00 b4 0a 00 00 84 07 53 97 56 5c 69 ...........S.V\i 0050 36 87 a4 45 8e 35 13 22 8b f4 38 ee 41 53 c1 0a 6..E.5."..8.AS.. 0060 2b 9c 6b c5 c9 ab ba 56 a3 55 f6 11 9d 89 c1 73 +.k....V.U.....s 0070 85 7e b0 a4 e2 04 5a 7b 2a 73 91 31 77 21 e5 1c .~....Z{*s.1w!.. 0080 67 31 f5 1d 5b 89 1a 4c 57 75 54 84 96 f9 57 57 g1..[..LWuT...WW 0090 73 13 76 ba e1 26 ae c7 68 8f 4e 9f d0 19 47 ec s.v..&..h.N...G. 00a0 99 ee 65 1a c4 00 90 ad d0 c5 5d 3d aa 8a db 18 ..e.......]=.... 00b0 8c 6e 9b 5b f6 24 f2 72 38 14 5f 3d 8a fe 0b ef .n.[.$.r8._=.... 00c0 f2 7c 97 d0 e0 c8 a6 07 53 ba 00 00 00 14 5e 8a .|......S.....^. 00d0 6f 64 6a fb 39 fe 2b 44 7c ec f8 13 c7 ae 10 13 odj.9.+D|....... 00e0 1c 0c .. Frame 4 (230 bytes on wire, 230 bytes captured) Arrival Time: Aug 15, 2006 11:12:15.931368000 Time delta from previous packet: 0.013508000 seconds Time since reference or first frame: 0.098924000 seconds Frame Number: 4 Packet Length: 230 bytes Capture Length: 230 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:0b:0b:00:00:01 (00:0b:0b:00:00:01), Dst: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa) Destination: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa) Source: 00:0b:0b:00:00:01 (00:0b:0b:00:00:01) Type: IP (0x0800) Frame check sequence: 0xc9bdfcf2 [correct] Internet Protocol, Src: 165.227.249.148 (165.227.249.148), Dst: 165.227.249.150 (165.227.249.150) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 212 Identification: 0x0003 (3) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 255 Protocol: UDP (0x11) Header checksum: 0x7c23 [correct] Good: True Bad : False Source: 165.227.249.148 (165.227.249.148) Destination: 165.227.249.150 (165.227.249.150) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 192 Checksum: 0xb19d [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0x3B909DFBB2DFE76E Responder cookie: 0xF7CE6EF3C4D5C3E6 Next payload: Key Exchange (4) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 184 Key Exchange payload Next payload: Nonce (10) Length: 132 Key Exchange Data Nonce payload Next payload: NONE (0) Length: 24 Nonce Data 0000 00 0c 29 96 e1 fa 00 0b 0b 00 00 01 08 00 45 00 ..)...........E. 0010 00 d4 00 03 00 00 ff 11 7c 23 a5 e3 f9 94 a5 e3 ........|#...... 0020 f9 96 01 f4 01 f4 00 c0 b1 9d 3b 90 9d fb b2 df ..........;..... 0030 e7 6e f7 ce 6e f3 c4 d5 c3 e6 04 10 02 00 00 00 .n..n........... 0040 00 00 00 00 00 b8 0a 00 00 84 41 d6 e0 c4 5f c4 ..........A..._. 0050 2b 4e 81 c1 93 87 13 3e 75 38 81 29 ff 6b 57 35 +N.....>u8.).kW5 0060 41 f7 bc c9 63 e9 d0 02 59 2c b9 ed 27 21 16 30 A...c...Y,..'!.0 0070 b6 b1 24 af 00 26 1a a0 8a 86 04 11 0f c6 9c 2c ..$..&........., 0080 ed 06 17 82 d0 f3 62 2b 69 9f 7e df 54 b1 c2 24 ......b+i.~.T..$ 0090 e9 fc ac 90 22 a1 e4 25 93 27 13 2a e1 30 e9 7d ...."..%.'.*.0.} 00a0 7c bc 17 bc 84 de 98 e9 ad c4 f4 ee 73 6e a8 ee |...........sn.. 00b0 13 e6 fc 0e c7 3a 96 3a 76 3e b8 18 bd 51 a7 72 .....:.:v>...Q.r 00c0 38 73 8e e5 03 04 e4 22 f8 84 00 00 00 18 5a 54 8s....."......ZT 00d0 d4 58 ce 4e 39 06 5a ec 1e 1e e9 af 3d 66 c2 3c .X.N9.Z.....=f.< 00e0 c7 a8 c9 bd fc f2 ...... Frame 5 (146 bytes on wire, 146 bytes captured) Arrival Time: Aug 15, 2006 11:12:16.069495000 Time delta from previous packet: 0.138127000 seconds Time since reference or first frame: 0.237051000 seconds Frame Number: 5 Packet Length: 146 bytes Capture Length: 146 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa), Dst: 00:0b:0b:00:00:01 (00:0b:0b:00:00:01) Destination: 00:0b:0b:00:00:01 (00:0b:0b:00:00:01) Source: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa) Type: IP (0x0800) Frame check sequence: 0xe777b96f [correct] Internet Protocol, Src: 165.227.249.150 (165.227.249.150), Dst: 165.227.249.148 (165.227.249.148) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 128 Identification: 0x01b6 (438) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: UDP (0x11) Header checksum: 0xf9c4 [correct] Good: True Bad : False Source: 165.227.249.150 (165.227.249.150) Destination: 165.227.249.148 (165.227.249.148) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 108 Checksum: 0x35f8 [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0x3B909DFBB2DFE76E Responder cookie: 0xF7CE6EF3C4D5C3E6 Next payload: Identification (5) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 100 Encrypted payload (72 bytes) 0000 00 0b 0b 00 00 01 00 0c 29 96 e1 fa 08 00 45 00 ........).....E. 0010 00 80 01 b6 00 00 80 11 f9 c4 a5 e3 f9 96 a5 e3 ................ 0020 f9 94 01 f4 01 f4 00 6c 35 f8 3b 90 9d fb b2 df .......l5.;..... 0030 e7 6e f7 ce 6e f3 c4 d5 c3 e6 05 10 02 01 00 00 .n..n........... 0040 00 00 00 00 00 64 97 34 b7 78 3a ed 0b c6 3b 9a .....d.4.x:...;. 0050 9e 59 95 30 cf 10 b9 29 35 a2 92 9e 82 db ed 4f .Y.0...)5......O 0060 07 30 4e da 55 1b dd d5 1f 4a 0b 3f b6 fd 82 f5 .0N.U....J.?.... 0070 a3 ca 53 c2 8b 6c fd a0 ac 3b 2f 14 0a f9 00 2f ..S..l...;/..../ 0080 67 48 e0 59 75 6e 46 22 d6 b3 cd 47 5a 90 e7 77 gH.YunF"...GZ..w 0090 b9 6f .o Frame 6 (138 bytes on wire, 138 bytes captured) Arrival Time: Aug 15, 2006 11:12:16.080492000 Time delta from previous packet: 0.010997000 seconds Time since reference or first frame: 0.248048000 seconds Frame Number: 6 Packet Length: 138 bytes Capture Length: 138 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:0b:0b:00:00:01 (00:0b:0b:00:00:01), Dst: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa) Destination: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa) Source: 00:0b:0b:00:00:01 (00:0b:0b:00:00:01) Type: IP (0x0800) Frame check sequence: 0x482c007d [correct] Internet Protocol, Src: 165.227.249.148 (165.227.249.148), Dst: 165.227.249.150 (165.227.249.150) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 120 Identification: 0x0004 (4) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 255 Protocol: UDP (0x11) Header checksum: 0x7c7e [correct] Good: True Bad : False Source: 165.227.249.148 (165.227.249.148) Destination: 165.227.249.150 (165.227.249.150) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 100 Checksum: 0x31f1 [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0x3B909DFBB2DFE76E Responder cookie: 0xF7CE6EF3C4D5C3E6 Next payload: Identification (5) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 92 Encrypted payload (64 bytes) 0000 00 0c 29 96 e1 fa 00 0b 0b 00 00 01 08 00 45 00 ..)...........E. 0010 00 78 00 04 00 00 ff 11 7c 7e a5 e3 f9 94 a5 e3 .x......|~...... 0020 f9 96 01 f4 01 f4 00 64 31 f1 3b 90 9d fb b2 df .......d1.;..... 0030 e7 6e f7 ce 6e f3 c4 d5 c3 e6 05 10 02 01 00 00 .n..n........... 0040 00 00 00 00 00 5c 2f 20 9a a4 d3 53 55 1f a6 1f .....\/ ...SU... 0050 c5 f1 b6 c6 e8 f1 71 3d 1b 44 2e 0b 5c 4e be 8d ......q=.D..\N.. 0060 0b 57 33 0a 39 82 12 e8 75 46 cb c5 b7 26 33 55 .W3.9...uF...&3U 0070 62 b8 88 90 6a 9b 70 20 1c 4b d1 27 7b 28 80 3e b...j.p .K.'{(.> 0080 10 dd 93 da 42 3f 48 2c 00 7d ....B?H,.} Frame 7 (338 bytes on wire, 338 bytes captured) Arrival Time: Aug 15, 2006 11:12:16.212962000 Time delta from previous packet: 0.132470000 seconds Time since reference or first frame: 0.380518000 seconds Frame Number: 7 Packet Length: 338 bytes Capture Length: 338 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa), Dst: 00:0b:0b:00:00:01 (00:0b:0b:00:00:01) Destination: 00:0b:0b:00:00:01 (00:0b:0b:00:00:01) Source: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa) Type: IP (0x0800) Frame check sequence: 0xbc342275 [correct] Internet Protocol, Src: 165.227.249.150 (165.227.249.150), Dst: 165.227.249.148 (165.227.249.148) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 320 Identification: 0x01b7 (439) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: UDP (0x11) Header checksum: 0xf903 [correct] Good: True Bad : False Source: 165.227.249.150 (165.227.249.150) Destination: 165.227.249.148 (165.227.249.148) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 300 Checksum: 0xef6a [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0x3B909DFBB2DFE76E Responder cookie: 0xF7CE6EF3C4D5C3E6 Next payload: Hash (8) Version: 1.0 Exchange type: Quick Mode (32) Flags .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x452BD126 Length: 292 Encrypted payload (264 bytes) 0000 00 0b 0b 00 00 01 00 0c 29 96 e1 fa 08 00 45 00 ........).....E. 0010 01 40 01 b7 00 00 80 11 f9 03 a5 e3 f9 96 a5 e3 .@.............. 0020 f9 94 01 f4 01 f4 01 2c ef 6a 3b 90 9d fb b2 df .......,.j;..... 0030 e7 6e f7 ce 6e f3 c4 d5 c3 e6 08 10 20 01 45 2b .n..n....... .E+ 0040 d1 26 00 00 01 24 50 8d da 37 d6 18 43 bc 46 e3 .&...$P..7..C.F. 0050 5f 51 f3 7d 0f 34 28 90 64 95 4a af 01 4f ef e1 _Q.}.4(.d.J..O.. 0060 77 dd e7 68 3f 12 a2 73 f6 28 1e d7 32 b4 f0 3b w..h?..s.(..2..; 0070 33 d1 73 a2 7b 12 82 af 7c c3 6f 3a f5 b4 fe c2 3.s.{...|.o:.... 0080 d9 82 02 c2 84 3e b5 9c 45 92 58 ed 03 be 45 fc .....>..E.X...E. 0090 17 4c b1 76 94 82 f2 bc a9 d2 c1 3e f0 1a 03 86 .L.v.......>.... 00a0 b7 51 bc 03 b1 65 36 5e 12 b5 dd 4d a8 12 02 b9 .Q...e6^...M.... 00b0 16 bd 81 1b 5c 51 11 a6 72 f0 50 ba 06 05 17 4b ....\Q..r.P....K 00c0 e0 7c d5 37 5c b0 05 91 66 18 d3 e1 02 e4 1b fb .|.7\...f....... 00d0 ca ab 38 a4 fb 02 84 eb 33 94 cb c9 54 07 7d 67 ..8.....3...T.}g 00e0 a7 7a 9a a0 a9 44 99 a4 87 e9 80 7a bb 20 3c 70 .z...D.....z.

.X.....5.LF 0110 0f 46 1e 5d 57 4b 69 77 cf 9e fd 08 f2 29 a2 db .F.]WKiw.....).. 0120 2d dd d5 b5 0e ea b0 11 bd 84 17 6b c6 eb e0 1f -..........k.... 0130 14 64 9d dd 3e c1 b3 4d 89 0a f6 df a4 02 67 ab .d..>..M......g. 0140 1a 91 01 e9 14 22 68 a4 6e fa 7b dc e6 45 bc 34 ....."h.n.{..E.4 0150 22 75 "u Frame 8 (338 bytes on wire, 338 bytes captured) Arrival Time: Aug 15, 2006 11:12:16.236471000 Time delta from previous packet: 0.023509000 seconds Time since reference or first frame: 0.404027000 seconds Frame Number: 8 Packet Length: 338 bytes Capture Length: 338 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:0b:0b:00:00:01 (00:0b:0b:00:00:01), Dst: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa) Destination: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa) Source: 00:0b:0b:00:00:01 (00:0b:0b:00:00:01) Type: IP (0x0800) Frame check sequence: 0xca1733c8 [correct] Internet Protocol, Src: 165.227.249.148 (165.227.249.148), Dst: 165.227.249.150 (165.227.249.150) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 320 Identification: 0x0005 (5) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 255 Protocol: UDP (0x11) Header checksum: 0x7bb5 [correct] Good: True Bad : False Source: 165.227.249.148 (165.227.249.148) Destination: 165.227.249.150 (165.227.249.150) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 300 Checksum: 0x6be4 [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0x3B909DFBB2DFE76E Responder cookie: 0xF7CE6EF3C4D5C3E6 Next payload: Hash (8) Version: 1.0 Exchange type: Quick Mode (32) Flags .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x452BD126 Length: 292 Encrypted payload (264 bytes) 0000 00 0c 29 96 e1 fa 00 0b 0b 00 00 01 08 00 45 00 ..)...........E. 0010 01 40 00 05 00 00 ff 11 7b b5 a5 e3 f9 94 a5 e3 .@......{....... 0020 f9 96 01 f4 01 f4 01 2c 6b e4 3b 90 9d fb b2 df .......,k.;..... 0030 e7 6e f7 ce 6e f3 c4 d5 c3 e6 08 10 20 01 45 2b .n..n....... .E+ 0040 d1 26 00 00 01 24 8d 9c 97 88 63 df 7c ed 8b 53 .&...$....c.|..S 0050 87 f2 62 c3 fb 51 b8 78 8c f8 1f 2f 26 c6 2f 28 ..b..Q.x.../&./( 0060 9a 70 08 f4 cd 4a 90 d9 65 b5 72 44 cd 9f 7d a1 .p...J..e.rD..}. 0070 42 19 2d 08 6e 91 2c df 64 ed bc cb 04 a1 78 6e B.-.n.,.d.....xn 0080 c9 d0 89 bc 34 67 bb f9 ed ad e3 fd 8a a4 b3 6f ....4g.........o 0090 b0 3c 19 5f 52 77 ee 33 1b 85 6f 18 45 04 f7 7f .<._Rw.3..o.E... 00a0 22 27 14 65 37 24 cf 64 75 89 71 16 92 a4 3c 1b "'.e7$.du.q...<. 00b0 de fa 68 33 79 d5 a2 ff a6 aa 6f 0a 92 4e 9e 88 ..h3y.....o..N.. 00c0 3e c7 87 a2 55 42 1a b9 8e ff f7 36 70 a6 97 98 >...UB.....6p... 00d0 83 22 c7 45 36 76 b3 22 13 f0 8f 6e c7 c8 19 97 .".E6v."...n.... 00e0 d9 a9 72 0b 00 d4 c4 b0 66 8d ff b4 85 2b 77 51 ..r.....f....+wQ 00f0 3d 6e c8 ee 40 16 f5 d9 80 f2 48 d4 61 4d af d8 =n..@.....H.aM.. 0100 6c 00 76 6e f1 99 ed 23 61 ca af ec cd ff f0 af l.vn...#a....... 0110 9d 27 dd 9c 2b ef b6 ba c0 fe c4 72 1e 70 9d fc .'..+......r.p.. 0120 70 28 09 b3 e0 b8 77 74 55 92 0b b1 bc 4b df f9 p(....wtU....K.. 0130 10 e0 73 0a 85 83 2a 31 0b 5e 00 46 04 81 6c 7f ..s...*1.^.F..l. 0140 eb 2e 44 f4 90 f8 9b 91 3a a8 ab a6 ed 5f ca 17 ..D.....:...._.. 0150 33 c8 3. Frame 9 (106 bytes on wire, 106 bytes captured) Arrival Time: Aug 15, 2006 11:12:16.726712000 Time delta from previous packet: 0.490241000 seconds Time since reference or first frame: 0.894268000 seconds Frame Number: 9 Packet Length: 106 bytes Capture Length: 106 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa), Dst: 00:0b:0b:00:00:01 (00:0b:0b:00:00:01) Destination: 00:0b:0b:00:00:01 (00:0b:0b:00:00:01) Source: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa) Type: IP (0x0800) Frame check sequence: 0xe045d562 [correct] Internet Protocol, Src: 165.227.249.150 (165.227.249.150), Dst: 165.227.249.148 (165.227.249.148) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 88 Identification: 0x01b8 (440) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: UDP (0x11) Header checksum: 0xf9ea [correct] Good: True Bad : False Source: 165.227.249.150 (165.227.249.150) Destination: 165.227.249.148 (165.227.249.148) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 68 Checksum: 0x4cfe [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0x3B909DFBB2DFE76E Responder cookie: 0xF7CE6EF3C4D5C3E6 Next payload: Hash (8) Version: 1.0 Exchange type: Quick Mode (32) Flags .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x452BD126 Length: 60 Encrypted payload (32 bytes) 0000 00 0b 0b 00 00 01 00 0c 29 96 e1 fa 08 00 45 00 ........).....E. 0010 00 58 01 b8 00 00 80 11 f9 ea a5 e3 f9 96 a5 e3 .X.............. 0020 f9 94 01 f4 01 f4 00 44 4c fe 3b 90 9d fb b2 df .......DL.;..... 0030 e7 6e f7 ce 6e f3 c4 d5 c3 e6 08 10 20 01 45 2b .n..n....... .E+ 0040 d1 26 00 00 00 3c f8 a8 ff 86 f4 43 b1 86 13 aa .&...<.....C.... 0050 c5 09 af 86 a5 ae ff 41 d9 a2 0d 06 13 b6 32 dd .......A......2. 0060 d9 d5 94 49 67 13 e0 45 d5 62 ...Ig..E.b Frame 10 (402 bytes on wire, 402 bytes captured) Arrival Time: Aug 15, 2006 11:12:24.051787000 Time delta from previous packet: 7.325075000 seconds Time since reference or first frame: 8.219343000 seconds Frame Number: 10 Packet Length: 402 bytes Capture Length: 402 bytes Protocols in frame: eth:ip:esp:data Ethernet II, Src: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa), Dst: 00:0b:0b:00:00:01 (00:0b:0b:00:00:01) Destination: 00:0b:0b:00:00:01 (00:0b:0b:00:00:01) Source: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa) Type: IP (0x0800) Frame check sequence: 0x0eba829c [correct] Internet Protocol, Src: 165.227.249.150 (165.227.249.150), Dst: 165.227.249.148 (165.227.249.148) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 384 Identification: 0x01b9 (441) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: ESP (0x32) Header checksum: 0xf8a0 [correct] Good: True Bad : False Source: 165.227.249.150 (165.227.249.150) Destination: 165.227.249.148 (165.227.249.148) Encapsulating Security Payload SPI: 0x58746da6 Sequence: 1 Data (356 bytes) 0000 00 0b 0b 00 00 01 00 0c 29 96 e1 fa 08 00 45 00 ........).....E. 0010 01 80 01 b9 00 00 80 32 f8 a0 a5 e3 f9 96 a5 e3 .......2........ 0020 f9 94 58 74 6d a6 00 00 00 01 b0 ab 5b 58 e7 e3 ..Xtm.......[X.. 0030 79 22 f2 37 10 3e 34 92 8a 65 54 ad 58 17 8d 38 y".7.>4..eT.X..8 0040 1f 31 16 c8 ea ee 26 4e 37 6b ab c7 9c 36 e9 c7 .1....&N7k...6.. 0050 33 59 36 da f1 db af 63 d4 44 4d 53 ae 49 3a 42 3Y6....c.DMS.I:B 0060 cc 91 33 c0 90 fd 1f ce a0 b7 a4 d9 bf 3f a3 27 ..3..........?.' 0070 b1 42 ad 68 03 c6 28 9c 8e 57 11 00 4f 0d a1 70 .B.h..(..W..O..p 0080 d0 f1 a9 f3 37 33 db 8f dd e3 b7 b1 0f a0 b3 b4 ....73.......... 0090 80 a7 2d 98 83 19 e0 c5 2e 72 85 3e 21 f1 f4 13 ..-......r.>!... 00a0 e7 c4 79 43 e2 c1 1a 9a 1b 6f b7 13 1c c9 54 a5 ..yC.....o....T. 00b0 d8 74 5e d8 4a fe 7d b0 ab 15 7d 17 c4 c4 00 9e .t^.J.}...}..... 00c0 86 96 e3 8a 4f 6e c6 44 f8 1c bb 0e dc 4f 9f c1 ....On.D.....O.. 00d0 73 89 ed 98 8f 9c a2 15 21 3b dd 05 f8 05 b4 4a s.......!;.....J 00e0 74 f6 83 6d 3b 94 42 be 78 02 d8 ea 97 6d 5f e2 t..m;.B.x....m_. 00f0 36 68 30 d1 83 01 2c 8f f7 5f ed fb a9 8e 41 fb 6h0...,.._....A. 0100 de c1 d8 63 72 73 3e 74 52 0c e2 70 d9 3e 34 db ...crs>tR..p.>4. 0110 c9 d5 9f 1e 02 b6 66 1b dc 3e b6 87 99 e2 42 8b ......f..>....B. 0120 93 b2 d2 da 02 1e f4 e1 09 3c 85 2d d1 8f 8f 43 .........<.-...C 0130 1f ea a0 15 b2 01 68 3f f7 07 48 87 72 dd 48 98 ......h?..H.r.H. 0140 83 1d 4a 6f 9c d8 26 6f 91 d6 1b 8f fe de b2 8c ..Jo..&o........ 0150 55 34 8d 2e 48 c5 f1 fe b5 ad 40 56 1e 94 3e 96 U4..H.....@V..>. 0160 4a 5c 8d 9b 06 31 d2 4a 8a 20 55 71 89 f9 8a 9c J\...1.J. Uq.... 0170 d3 d7 5a 73 47 90 5e 72 7c e8 a7 db af fe e9 31 ..ZsG.^r|......1 0180 78 8a 44 db 17 e1 9d 94 30 a8 95 46 48 c9 0e ba x.D.....0..FH... 0190 82 9c .. Frame 11 (402 bytes on wire, 402 bytes captured) Arrival Time: Aug 15, 2006 11:12:24.058905000 Time delta from previous packet: 0.007118000 seconds Time since reference or first frame: 8.226461000 seconds Frame Number: 11 Packet Length: 402 bytes Capture Length: 402 bytes Protocols in frame: eth:ip:esp:data Ethernet II, Src: 00:0b:0b:00:00:01 (00:0b:0b:00:00:01), Dst: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa) Destination: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa) Source: 00:0b:0b:00:00:01 (00:0b:0b:00:00:01) Type: IP (0x0800) Frame check sequence: 0x73c8f98c [correct] Internet Protocol, Src: 165.227.249.148 (165.227.249.148), Dst: 165.227.249.150 (165.227.249.150) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 384 Identification: 0x0006 (6) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 255 Protocol: ESP (0x32) Header checksum: 0x7b53 [correct] Good: True Bad : False Source: 165.227.249.148 (165.227.249.148) Destination: 165.227.249.150 (165.227.249.150) Encapsulating Security Payload SPI: 0x78777654 Sequence: 1 Data (356 bytes) 0000 00 0c 29 96 e1 fa 00 0b 0b 00 00 01 08 00 45 00 ..)...........E. 0010 01 80 00 06 00 00 ff 32 7b 53 a5 e3 f9 94 a5 e3 .......2{S...... 0020 f9 96 78 77 76 54 00 00 00 01 01 02 03 04 05 06 ..xwvT.......... 0030 07 08 b8 d7 5a b9 91 0c 16 84 f2 da f1 07 48 0f ....Z.........H. 0040 c3 6f b5 a1 00 8f f9 20 a8 20 06 a0 29 09 a3 7e .o..... . ..)..~ 0050 c1 f6 34 f4 ef 4e 0d be 36 ef 74 8f 70 f8 94 26 ..4..N..6.t.p..& 0060 36 55 83 86 37 3c f4 84 bb 07 ea 0f e6 8d fa f3 6U..7<.......... 0070 be 50 a7 eb ff f9 65 74 ca 01 05 27 86 1c 19 7a .P....et...'...z 0080 5e 55 05 72 9c f0 a3 f1 12 80 2d 3f ee f3 a0 9f ^U.r......-?.... 0090 a7 15 af 36 ed 5a 10 2f 42 24 46 5c 04 f3 31 a0 ...6.Z./B$F\..1. 00a0 79 6d bd 6d 56 a1 36 0e 8b 6e 05 21 55 84 49 47 ym.mV.6..n.!U.IG 00b0 4b 80 b4 5d 7a 22 0c 60 29 3a af 44 26 ef ad ed K..]z".`):.D&... 00c0 c7 06 59 0b 10 e3 a2 98 2b 04 e3 7c be 86 6a 02 ..Y.....+..|..j. 00d0 d8 55 db fc de d7 b0 b5 79 fd c0 02 20 0c c0 00 .U......y... ... 00e0 da 14 37 18 07 b6 a5 f8 4f c8 9a ff a2 b1 3c 2c ..7.....O.....<, 00f0 ea 4d 39 85 98 0c 8e ef c0 bf 7b a1 83 3f f4 40 .M9.......{..?.@ 0100 d7 8d 34 cd 32 3e 95 49 c5 40 38 f1 cb 59 c2 ff ..4.2>.I.@8..Y.. 0110 23 63 72 59 5e dd 64 eb 3c 1b 06 72 6f 15 72 53 #crY^.d.<..ro.rS 0120 e3 c8 91 27 cc 7b c0 f2 9f ac 04 07 4a ec 6b 8e ...'.{......J.k. 0130 d7 89 88 6f 41 6f 6c 7b 1a c0 6f 60 be 48 c5 d9 ...oAol{..o`.H.. 0140 6e b0 de 65 91 29 04 94 85 eb 9d b9 52 7f 94 d9 n..e.)......R... 0150 b6 af ee dd 14 b2 fc 6a ed e7 be 55 b1 17 b9 a6 .......j...U.... 0160 f8 13 6d ad 32 1e 62 72 ee df 53 4e 9d 89 92 36 ..m.2.br..SN...6 0170 16 81 b8 5b 7f 2f 1b 57 23 05 3f ed 11 2d 13 7b ...[./.W#.?..-.{ 0180 9e 24 72 a1 a3 20 df 07 d5 89 92 c8 e1 71 73 c8 .$r.. .......qs. 0190 f9 8c ..