Frame 1 (222 bytes on wire, 222 bytes captured) Arrival Time: Aug 10, 2006 14:11:15.903589000 Time delta from previous packet: 0.000000000 seconds Time since reference or first frame: 0.000000000 seconds Frame Number: 1 Packet Length: 222 bytes Capture Length: 222 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa), Dst: 00:60:26:20:00:1f (00:60:26:20:00:1f) Destination: 00:60:26:20:00:1f (00:60:26:20:00:1f) Source: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.150 (165.227.249.150), Dst: 165.227.249.149 (165.227.249.149) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 208 Identification: 0x01eb (491) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: UDP (0x11) Header checksum: 0xf93e [correct] Good: True Bad : False Source: 165.227.249.150 (165.227.249.150) Destination: 165.227.249.149 (165.227.249.149) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 188 Checksum: 0xe0b9 [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0xFB5CA6B1C6138D9C Responder cookie: 0x0000000000000000 Next payload: Security Association (1) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 180 Security Association payload Next payload: Vendor ID (13) Length: 52 Domain of interpretation: IPSEC (1) Situation: IDENTITY (1) Proposal payload # 1 Next payload: NONE (0) Length: 40 Proposal number: 1 Protocol ID: ISAKMP (1) SPI size: 0 Number of transforms: 1 Transform payload # 1 Next payload: NONE (0) Length: 32 Transform number: 1 Transform ID: KEY_IKE (1) Encryption-Algorithm (1): 3DES-CBC (5) Hash-Algorithm (2): SHA (2) Group-Description (4): Alternate 1024-bit MODP group (2) Authentication-Method (3): PSK (1) Life-Type (11): Seconds (1) Life-Duration (12): Duration-Value (28800) Vendor ID payload Next payload: Vendor ID (13) Length: 20 Vendor ID: unknown vendor ID: 0x4A131C81070358455C5728F20E95452F Vendor ID payload Next payload: Vendor ID (13) Length: 20 Vendor ID: draft-ietf-ipsec-nat-t-ike-03 Vendor ID payload Next payload: Vendor ID (13) Length: 20 Vendor ID: draft-ietf-ipsec-nat-t-ike-02 Vendor ID payload Next payload: Vendor ID (13) Length: 20 Vendor ID: draft-ietf-ipsec-nat-t-ike-00 Vendor ID payload Next payload: NONE (0) Length: 20 Vendor ID: RFC 3706 Detecting Dead IKE Peers (DPD) 0000 00 60 26 20 00 1f 00 0c 29 96 e1 fa 08 00 45 00 .`& ....).....E. 0010 00 d0 01 eb 00 00 80 11 f9 3e a5 e3 f9 96 a5 e3 .........>...... 0020 f9 95 01 f4 01 f4 00 bc e0 b9 fb 5c a6 b1 c6 13 ...........\.... 0030 8d 9c 00 00 00 00 00 00 00 00 01 10 02 00 00 00 ................ 0040 00 00 00 00 00 b4 0d 00 00 34 00 00 00 01 00 00 .........4...... 0050 00 01 00 00 00 28 01 01 00 01 00 00 00 20 01 01 .....(....... .. 0060 00 00 80 01 00 05 80 02 00 02 80 04 00 02 80 03 ................ 0070 00 01 80 0b 00 01 80 0c 70 80 0d 00 00 14 4a 13 ........p.....J. 0080 1c 81 07 03 58 45 5c 57 28 f2 0e 95 45 2f 0d 00 ....XE\W(...E/.. 0090 00 14 7d 94 19 a6 53 10 ca 6f 2c 17 9d 92 15 52 ..}...S..o,....R 00a0 9d 56 0d 00 00 14 90 cb 80 91 3e bb 69 6e 08 63 .V........>.in.c 00b0 81 b5 ec 42 7b 1f 0d 00 00 14 44 85 15 2d 18 b6 ...B{.....D..-.. 00c0 bb cd 0b e8 a8 46 95 79 dd cc 00 00 00 14 af ca .....F.y........ 00d0 d7 13 68 a1 f1 c9 6b 86 96 fc 77 57 01 00 ..h...k...wW.. Frame 2 (122 bytes on wire, 122 bytes captured) Arrival Time: Aug 10, 2006 14:11:15.951980000 Time delta from previous packet: 0.048391000 seconds Time since reference or first frame: 0.048391000 seconds Frame Number: 2 Packet Length: 122 bytes Capture Length: 122 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:60:26:20:00:1f (00:60:26:20:00:1f), Dst: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa) Destination: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa) Source: 00:60:26:20:00:1f (00:60:26:20:00:1f) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.149 (165.227.249.149), Dst: 165.227.249.150 (165.227.249.150) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 108 Identification: 0x0000 (0) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfb8d [correct] Good: True Bad : False Source: 165.227.249.149 (165.227.249.149) Destination: 165.227.249.150 (165.227.249.150) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 88 Checksum: 0x8ca0 [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0xFB5CA6B1C6138D9C Responder cookie: 0x9D370BF85623C41F Next payload: Security Association (1) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 80 Security Association payload Next payload: NONE (0) Length: 52 Domain of interpretation: IPSEC (1) Situation: IDENTITY (1) Proposal payload # 1 Next payload: NONE (0) Length: 40 Proposal number: 1 Protocol ID: ISAKMP (1) SPI size: 0 Number of transforms: 1 Transform payload # 1 Next payload: NONE (0) Length: 32 Transform number: 1 Transform ID: KEY_IKE (1) Encryption-Algorithm (1): 3DES-CBC (5) Hash-Algorithm (2): SHA (2) Group-Description (4): Alternate 1024-bit MODP group (2) Authentication-Method (3): PSK (1) Life-Type (11): Seconds (1) Life-Duration (12): Duration-Value (28800) 0000 00 0c 29 96 e1 fa 00 60 26 20 00 1f 08 00 45 00 ..)....`& ....E. 0010 00 6c 00 00 40 00 40 11 fb 8d a5 e3 f9 95 a5 e3 .l..@.@......... 0020 f9 96 01 f4 01 f4 00 58 8c a0 fb 5c a6 b1 c6 13 .......X...\.... 0030 8d 9c 9d 37 0b f8 56 23 c4 1f 01 10 02 00 00 00 ...7..V#........ 0040 00 00 00 00 00 50 00 00 00 34 00 00 00 01 00 00 .....P...4...... 0050 00 01 00 00 00 28 01 01 00 01 00 00 00 20 01 01 .....(....... .. 0060 00 00 80 01 00 05 80 02 00 02 80 04 00 02 80 03 ................ 0070 00 01 80 0b 00 01 80 0c 70 80 ........p. Frame 3 (222 bytes on wire, 222 bytes captured) Arrival Time: Aug 10, 2006 14:11:15.991537000 Time delta from previous packet: 0.039557000 seconds Time since reference or first frame: 0.087948000 seconds Frame Number: 3 Packet Length: 222 bytes Capture Length: 222 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa), Dst: 00:60:26:20:00:1f (00:60:26:20:00:1f) Destination: 00:60:26:20:00:1f (00:60:26:20:00:1f) Source: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.150 (165.227.249.150), Dst: 165.227.249.149 (165.227.249.149) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 208 Identification: 0x01ec (492) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: UDP (0x11) Header checksum: 0xf93d [correct] Good: True Bad : False Source: 165.227.249.150 (165.227.249.150) Destination: 165.227.249.149 (165.227.249.149) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 188 Checksum: 0xc1fb [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0xFB5CA6B1C6138D9C Responder cookie: 0x9D370BF85623C41F Next payload: Key Exchange (4) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 180 Key Exchange payload Next payload: Nonce (10) Length: 132 Key Exchange Data Nonce payload Next payload: NONE (0) Length: 20 Nonce Data 0000 00 60 26 20 00 1f 00 0c 29 96 e1 fa 08 00 45 00 .`& ....).....E. 0010 00 d0 01 ec 00 00 80 11 f9 3d a5 e3 f9 96 a5 e3 .........=...... 0020 f9 95 01 f4 01 f4 00 bc c1 fb fb 5c a6 b1 c6 13 ...........\.... 0030 8d 9c 9d 37 0b f8 56 23 c4 1f 04 10 02 00 00 00 ...7..V#........ 0040 00 00 00 00 00 b4 0a 00 00 84 06 2d ec d7 b9 a2 ...........-.... 0050 61 39 19 24 fc 75 0d 9d b4 0a 34 ed 75 f2 93 ac a9.$.u....4.u... 0060 d2 bc 90 e0 59 88 da 2a 26 c0 75 11 d5 e3 29 a7 ....Y..*&.u...). 0070 4f 5e 23 8c 28 72 6b 68 7e 40 07 da 65 78 b4 df O^#.(rkh~@..ex.. 0080 3f 27 10 59 61 93 5a 1b 87 a8 b6 1c be 26 af be ?'.Ya.Z......&.. 0090 36 15 5f 48 16 07 2f b6 59 46 f5 3c fa c3 81 31 6._H../.YF.<...1 00a0 87 e7 1b 55 c5 e5 47 92 ba 0c ea 9d 1e 10 cd b4 ...U..G......... 00b0 18 22 c3 ee 7d 87 99 8f da 17 14 fa 51 81 26 f8 ."..}.......Q.&. 00c0 40 e9 74 2e 31 26 fe 34 d5 b0 00 00 00 14 8f 9e @.t.1&.4........ 00d0 de 68 a6 79 75 91 8d 24 6c 70 eb 15 10 57 .h.yu..$lp...W Frame 4 (222 bytes on wire, 222 bytes captured) Arrival Time: Aug 10, 2006 14:11:16.448078000 Time delta from previous packet: 0.456541000 seconds Time since reference or first frame: 0.544489000 seconds Frame Number: 4 Packet Length: 222 bytes Capture Length: 222 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:60:26:20:00:1f (00:60:26:20:00:1f), Dst: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa) Destination: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa) Source: 00:60:26:20:00:1f (00:60:26:20:00:1f) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.149 (165.227.249.149), Dst: 165.227.249.150 (165.227.249.150) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 208 Identification: 0x0000 (0) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfb29 [correct] Good: True Bad : False Source: 165.227.249.149 (165.227.249.149) Destination: 165.227.249.150 (165.227.249.150) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 188 Checksum: 0x6fe3 [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0xFB5CA6B1C6138D9C Responder cookie: 0x9D370BF85623C41F Next payload: Key Exchange (4) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 180 Key Exchange payload Next payload: Nonce (10) Length: 132 Key Exchange Data Nonce payload Next payload: NONE (0) Length: 20 Nonce Data 0000 00 0c 29 96 e1 fa 00 60 26 20 00 1f 08 00 45 00 ..)....`& ....E. 0010 00 d0 00 00 40 00 40 11 fb 29 a5 e3 f9 95 a5 e3 ....@.@..)...... 0020 f9 96 01 f4 01 f4 00 bc 6f e3 fb 5c a6 b1 c6 13 ........o..\.... 0030 8d 9c 9d 37 0b f8 56 23 c4 1f 04 10 02 00 00 00 ...7..V#........ 0040 00 00 00 00 00 b4 0a 00 00 84 14 88 f8 86 24 60 ..............$` 0050 93 68 18 74 6b 9d 79 1c ee 40 0b 42 07 d7 d1 90 .h.tk.y..@.B.... 0060 2f 41 f6 2c 49 f2 58 e6 7a 54 39 f0 41 5f be e0 /A.,I.X.zT9.A_.. 0070 5a 6d 7e be 81 e5 54 c5 06 f6 5b 87 a6 7c 4b 46 Zm~...T...[..|KF 0080 11 91 a9 27 90 b3 51 33 04 34 96 65 4d 4a fb c8 ...'..Q3.4.eMJ.. 0090 9e 70 8d 56 4c 11 73 67 f3 e1 bf ff 9e 48 ca 5a .p.VL.sg.....H.Z 00a0 b7 0b 0c 26 19 32 1a 05 fa d7 1b 1f 88 6e b1 2f ...&.2.......n./ 00b0 e7 bb e3 f9 c4 6a f9 3b 88 6f 1e 35 f7 df 2c d6 .....j.;.o.5..,. 00c0 67 bd c8 ca c7 aa 39 09 bd c5 00 00 00 14 c6 b7 g.....9......... 00d0 17 f3 eb 95 e5 6f fd 24 92 89 27 ec f2 41 .....o.$..'..A Frame 5 (142 bytes on wire, 142 bytes captured) Arrival Time: Aug 10, 2006 14:11:16.482614000 Time delta from previous packet: 0.034536000 seconds Time since reference or first frame: 0.579025000 seconds Frame Number: 5 Packet Length: 142 bytes Capture Length: 142 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa), Dst: 00:60:26:20:00:1f (00:60:26:20:00:1f) Destination: 00:60:26:20:00:1f (00:60:26:20:00:1f) Source: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.150 (165.227.249.150), Dst: 165.227.249.149 (165.227.249.149) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 128 Identification: 0x01ed (493) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: UDP (0x11) Header checksum: 0xf98c [correct] Good: True Bad : False Source: 165.227.249.150 (165.227.249.150) Destination: 165.227.249.149 (165.227.249.149) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 108 Checksum: 0x94d6 [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0xFB5CA6B1C6138D9C Responder cookie: 0x9D370BF85623C41F Next payload: Identification (5) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 100 Encrypted payload (72 bytes) 0000 00 60 26 20 00 1f 00 0c 29 96 e1 fa 08 00 45 00 .`& ....).....E. 0010 00 80 01 ed 00 00 80 11 f9 8c a5 e3 f9 96 a5 e3 ................ 0020 f9 95 01 f4 01 f4 00 6c 94 d6 fb 5c a6 b1 c6 13 .......l...\.... 0030 8d 9c 9d 37 0b f8 56 23 c4 1f 05 10 02 01 00 00 ...7..V#........ 0040 00 00 00 00 00 64 e1 a8 39 1e 9a ef ab 07 de 56 .....d..9......V 0050 9e 91 8e 7e 6e 6e 78 3e 5c c2 d0 b8 a1 1e 00 c0 ...~nnx>\....... 0060 15 01 1e 5f de b1 ea 85 27 a2 22 47 31 2c 37 ce ..._....'."G1,7. 0070 6a c3 ee 84 59 1f 47 36 91 54 b1 e1 07 ba d4 65 j...Y.G6.T.....e 0080 06 0a ce b4 cb f4 cd ad 54 c8 2a 5a 8e 9d ........T.*Z.. Frame 6 (110 bytes on wire, 110 bytes captured) Arrival Time: Aug 10, 2006 14:11:16.855123000 Time delta from previous packet: 0.372509000 seconds Time since reference or first frame: 0.951534000 seconds Frame Number: 6 Packet Length: 110 bytes Capture Length: 110 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:60:26:20:00:1f (00:60:26:20:00:1f), Dst: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa) Destination: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa) Source: 00:60:26:20:00:1f (00:60:26:20:00:1f) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.149 (165.227.249.149), Dst: 165.227.249.150 (165.227.249.150) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 96 Identification: 0x0000 (0) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfb99 [correct] Good: True Bad : False Source: 165.227.249.149 (165.227.249.149) Destination: 165.227.249.150 (165.227.249.150) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 76 Checksum: 0xb1d8 [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0xFB5CA6B1C6138D9C Responder cookie: 0x9D370BF85623C41F Next payload: Identification (5) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 68 Encrypted payload (40 bytes) 0000 00 0c 29 96 e1 fa 00 60 26 20 00 1f 08 00 45 00 ..)....`& ....E. 0010 00 60 00 00 40 00 40 11 fb 99 a5 e3 f9 95 a5 e3 .`..@.@......... 0020 f9 96 01 f4 01 f4 00 4c b1 d8 fb 5c a6 b1 c6 13 .......L...\.... 0030 8d 9c 9d 37 0b f8 56 23 c4 1f 05 10 02 01 00 00 ...7..V#........ 0040 00 00 00 00 00 44 e4 22 e3 53 83 88 e1 ea 0e 5a .....D.".S.....Z 0050 26 1f 53 72 91 b0 c0 95 58 b4 78 bf 0e fb c8 6d &.Sr....X.x....m 0060 d9 3c 1f e6 03 51 b0 eb 61 4e b9 33 d2 40 .<...Q..aN.3.@ Frame 7 (126 bytes on wire, 126 bytes captured) Arrival Time: Aug 10, 2006 14:11:16.860133000 Time delta from previous packet: 0.005010000 seconds Time since reference or first frame: 0.956544000 seconds Frame Number: 7 Packet Length: 126 bytes Capture Length: 126 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:60:26:20:00:1f (00:60:26:20:00:1f), Dst: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa) Destination: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa) Source: 00:60:26:20:00:1f (00:60:26:20:00:1f) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.149 (165.227.249.149), Dst: 165.227.249.150 (165.227.249.150) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 112 Identification: 0x0000 (0) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfb89 [correct] Good: True Bad : False Source: 165.227.249.149 (165.227.249.149) Destination: 165.227.249.150 (165.227.249.150) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 92 Checksum: 0x93a4 [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0xFB5CA6B1C6138D9C Responder cookie: 0x9D370BF85623C41F Next payload: Hash (8) Version: 1.0 Exchange type: Informational (5) Flags .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x9933EF13 Length: 84 Encrypted payload (56 bytes) 0000 00 0c 29 96 e1 fa 00 60 26 20 00 1f 08 00 45 00 ..)....`& ....E. 0010 00 70 00 00 40 00 40 11 fb 89 a5 e3 f9 95 a5 e3 .p..@.@......... 0020 f9 96 01 f4 01 f4 00 5c 93 a4 fb 5c a6 b1 c6 13 .......\...\.... 0030 8d 9c 9d 37 0b f8 56 23 c4 1f 08 10 05 01 99 33 ...7..V#.......3 0040 ef 13 00 00 00 54 ec 1d 49 ce c2 53 d5 7e 67 ae .....T..I..S.~g. 0050 6b 3a 93 fd 6a 05 70 e7 a5 e9 e7 53 e5 54 46 30 k:..j.p....S.TF0 0060 5f 06 51 5c 3f 0d d4 18 cf 81 54 27 c3 05 7f db _.Q\?.....T'.... 0070 ac 23 7e 72 23 ce 6e a1 f8 bc 71 66 c0 46 .#~r#.n...qf.F Frame 8 (334 bytes on wire, 334 bytes captured) Arrival Time: Aug 10, 2006 14:11:16.886805000 Time delta from previous packet: 0.026672000 seconds Time since reference or first frame: 0.983216000 seconds Frame Number: 8 Packet Length: 334 bytes Capture Length: 334 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa), Dst: 00:60:26:20:00:1f (00:60:26:20:00:1f) Destination: 00:60:26:20:00:1f (00:60:26:20:00:1f) Source: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.150 (165.227.249.150), Dst: 165.227.249.149 (165.227.249.149) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 320 Identification: 0x01ee (494) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: UDP (0x11) Header checksum: 0xf8cb [correct] Good: True Bad : False Source: 165.227.249.150 (165.227.249.150) Destination: 165.227.249.149 (165.227.249.149) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 300 Checksum: 0x0d96 [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0xFB5CA6B1C6138D9C Responder cookie: 0x9D370BF85623C41F Next payload: Hash (8) Version: 1.0 Exchange type: Quick Mode (32) Flags .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x299342BF Length: 292 Encrypted payload (264 bytes) 0000 00 60 26 20 00 1f 00 0c 29 96 e1 fa 08 00 45 00 .`& ....).....E. 0010 01 40 01 ee 00 00 80 11 f8 cb a5 e3 f9 96 a5 e3 .@.............. 0020 f9 95 01 f4 01 f4 01 2c 0d 96 fb 5c a6 b1 c6 13 .......,...\.... 0030 8d 9c 9d 37 0b f8 56 23 c4 1f 08 10 20 01 29 93 ...7..V#.... .). 0040 42 bf 00 00 01 24 d5 ee ba 2f d7 08 d2 29 d6 e7 B....$.../...).. 0050 0e aa 25 79 d8 c0 9c 03 f1 9b e2 c5 f8 a2 3c 65 ..%y............SL,.a.....|.l 0120 71 e3 43 0a 4e ab d4 e4 8c ef 77 97 93 4a ae 74 q.C.N.....w..J.t 0130 f4 e4 86 9d 95 ed c0 66 1d 27 e9 70 23 9f f1 eb .......f.'.p#... 0140 bf 8e 92 02 4f df 12 5d 1f 3c 05 9b df 44 ....O..].<...D Frame 9 (334 bytes on wire, 334 bytes captured) Arrival Time: Aug 10, 2006 14:11:17.330370000 Time delta from previous packet: 0.443565000 seconds Time since reference or first frame: 1.426781000 seconds Frame Number: 9 Packet Length: 334 bytes Capture Length: 334 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:60:26:20:00:1f (00:60:26:20:00:1f), Dst: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa) Destination: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa) Source: 00:60:26:20:00:1f (00:60:26:20:00:1f) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.149 (165.227.249.149), Dst: 165.227.249.150 (165.227.249.150) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 320 Identification: 0x0000 (0) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfab9 [correct] Good: True Bad : False Source: 165.227.249.149 (165.227.249.149) Destination: 165.227.249.150 (165.227.249.150) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 300 Checksum: 0x0d1d [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0xFB5CA6B1C6138D9C Responder cookie: 0x9D370BF85623C41F Next payload: Hash (8) Version: 1.0 Exchange type: Quick Mode (32) Flags .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x299342BF Length: 292 Encrypted payload (264 bytes) 0000 00 0c 29 96 e1 fa 00 60 26 20 00 1f 08 00 45 00 ..)....`& ....E. 0010 01 40 00 00 40 00 40 11 fa b9 a5 e3 f9 95 a5 e3 .@..@.@......... 0020 f9 96 01 f4 01 f4 01 2c 0d 1d fb 5c a6 b1 c6 13 .......,...\.... 0030 8d 9c 9d 37 0b f8 56 23 c4 1f 08 10 20 01 29 93 ...7..V#.... .). 0040 42 bf 00 00 01 24 17 1b 24 7a 55 59 67 5f 44 45 B....$..$zUYg_DE 0050 aa a5 85 43 37 e8 66 af ad 90 28 59 2d 43 c5 c0 ...C7.f...(Y-C.. 0060 2b e6 07 fd c3 9f 5a 0c cf 95 9c 80 3e c8 6a ea +.....Z.....>.j. 0070 18 cc 98 d9 76 90 c6 ba 50 06 dc e2 8d 52 70 5c ....v...P....Rp\ 0080 7e 9d 11 5f a5 b0 48 0f 36 9e 95 a0 22 04 6a 84 ~.._..H.6...".j. 0090 c5 a3 ff 01 a0 9f 01 2a d4 66 c1 75 43 f1 08 a5 .......*.f.uC... 00a0 1e 90 31 59 c6 45 33 fb 46 8b 10 94 39 11 35 c0 ..1Y.E3.F...9.5. 00b0 9f 96 18 69 d9 4e 47 a4 62 39 86 61 fa 66 eb 3b ...i.NG.b9.a.f.; 00c0 aa a3 a7 66 76 14 ae d9 70 4b d9 be 0b b5 59 bb ...fv...pK....Y. 00d0 67 9b db 1a 75 ce 72 29 04 a3 c1 09 68 31 ac cb g...u.r)....h1.. 00e0 62 55 73 0b b8 a8 a6 a9 3e 02 16 51 d5 cf 6c d4 bUs.....>..Q..l. 00f0 26 fd 85 da 2c 87 76 87 52 b3 d8 32 a7 52 90 50 &...,.v.R..2.R.P 0100 bb 9c 62 40 13 df 98 3c 6d d6 56 65 91 09 c1 cf ..b@..........6].n.. 00e0 c1 89 90 c2 5c 67 c8 ff 60 0c f9 65 dd 19 2f 73 ....\g..`..e../s 00f0 c5 d4 fa 46 d3 88 42 26 87 35 a7 1f 3e 58 b2 8a ...F..B&.5..>X.. 0100 83 42 70 4d a3 28 f6 9a 29 49 7d 51 64 8f ae 8b .BpM.(..)I}Qd... 0110 dd bd 9a ae 62 42 11 55 e7 d0 ef 8e 47 5d e5 c4 ....bB.U....G].. 0120 cb dc ae b6 83 c6 50 e8 bc ad 2b e7 56 fb 94 ad ......P...+.V... 0130 3b 58 a3 09 88 4d f7 23 d0 6a 2b 4f 35 c6 70 a2 ;X...M.#.j+O5.p. 0140 57 b0 dc 07 82 95 32 b2 d1 b8 80 e0 70 0c a3 78 W.....2.....p..x 0150 bf 67 21 59 32 bc e1 c1 fa de 02 bf fb 83 28 e5 .g!Y2.........(. 0160 e9 ce 53 c3 de ba 0c 76 54 43 a6 d9 a8 8a 20 21 ..S....vTC.... ! 0170 77 30 7e 82 cf 94 2f 17 43 f5 c0 96 bb 05 99 41 w0~.../.C......A 0180 f9 31 5a f7 ce 30 79 ea aa 02 dc ef b0 13 .1Z..0y....... Frame 12 (398 bytes on wire, 398 bytes captured) Arrival Time: Aug 10, 2006 14:11:26.531123000 Time delta from previous packet: 0.008880000 seconds Time since reference or first frame: 10.627534000 seconds Frame Number: 12 Packet Length: 398 bytes Capture Length: 398 bytes Protocols in frame: eth:ip:esp:data Ethernet II, Src: 00:60:26:20:00:1f (00:60:26:20:00:1f), Dst: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa) Destination: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa) Source: 00:60:26:20:00:1f (00:60:26:20:00:1f) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.149 (165.227.249.149), Dst: 165.227.249.150 (165.227.249.150) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 384 Identification: 0x0000 (0) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: ESP (0x32) Header checksum: 0x3a59 [correct] Good: True Bad : False Source: 165.227.249.149 (165.227.249.149) Destination: 165.227.249.150 (165.227.249.150) Encapsulating Security Payload SPI: 0x0289a076 Sequence: 1 Data (356 bytes) 0000 00 0c 29 96 e1 fa 00 60 26 20 00 1f 08 00 45 00 ..)....`& ....E. 0010 01 80 00 00 00 00 40 32 3a 59 a5 e3 f9 95 a5 e3 ......@2:Y...... 0020 f9 96 02 89 a0 76 00 00 00 01 00 00 00 00 00 00 .....v.......... 0030 00 00 14 d2 39 3a cb b7 15 88 61 32 3a 1b ed 0d ....9:....a2:... 0040 c7 ea 1d 3d 26 3d b2 57 21 a6 cf 5c 4a 7a 5d 11 ...=&=.W!..\Jz]. 0050 bf d2 32 29 6c dc f6 7d 22 c7 db 44 26 8f 86 8c ..2)l..}"..D&... 0060 97 af 20 c7 52 4b 2b 65 20 84 0b 0f 9f 7c 28 65 .. .RK+e ....|(e 0070 f1 8b 5f 60 bc 95 a7 b7 99 6f a4 e0 f7 eb 9b df .._`.....o...... 0080 91 3e dc c8 36 28 0e d5 ac 43 ff 82 2b 2b 28 e3 .>..6(...C..++(. 0090 78 18 ff 4b ae c3 06 48 a1 23 f9 fd d4 be b9 89 x..K...H.#...... 00a0 f0 b3 15 5d a6 69 6a 03 3c 99 ab ca 1a b1 4e fb ...].ij.<.....N. 00b0 b6 7a a8 86 16 99 49 28 81 8f 12 5b e2 10 35 77 .z....I(...[..5w 00c0 f4 1e dc e0 58 df 2b f8 3d d2 24 79 78 48 da 55 ....X.+.=.$yxH.U 00d0 a6 53 36 77 d4 31 55 57 67 ca b3 03 83 b1 17 3c .S6w.1UWg......< 00e0 94 97 aa d1 07 8a e3 10 69 25 9d be 23 be 10 9f ........i%..#... 00f0 ee 0b 71 80 f8 1c 2a 67 ef f0 1f 2e 17 0d 29 b8 ..q...*g......). 0100 63 63 8a 30 38 dd d5 f8 9a 51 fe a6 7e 87 30 50 cc.08....Q..~.0P 0110 3a 13 38 9d c8 57 de cf 59 35 4b 23 8b a7 0a 8d :.8..W..Y5K#.... 0120 c8 ab a3 2b b2 34 91 e4 5a 72 f3 67 31 51 17 f9 ...+.4..Zr.g1Q.. 0130 4a fc 49 14 ff 57 8e c8 54 f5 86 9c a0 3f 71 c8 J.I..W..T....?q. 0140 2f 2b 5a 60 2c 01 76 c1 e7 fa 7f 6b e5 66 cb 2d /+Z`,.v....k.f.- 0150 93 bd 21 57 72 3b 42 59 72 d5 22 d0 f8 e2 90 94 ..!Wr;BYr."..... 0160 31 64 7b 8d 87 84 37 96 83 b4 9c 3a e9 61 a1 22 1d{...7....:.a." 0170 c4 21 f5 32 de 9d bc 67 0c 95 92 c9 a1 f7 19 fe .!.2...g........ 0180 84 b4 d1 d8 b9 05 90 3c 30 d1 f6 4b 53 70 .......<0..KSp