Frame 1 (226 bytes on wire, 226 bytes captured) Arrival Time: Dec 14, 2007 12:50:12.494976000 Time delta from previous packet: 0.000000000 seconds Time since reference or first frame: 0.000000000 seconds Frame Number: 1 Packet Length: 226 bytes Capture Length: 226 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa), Dst: 00:11:22:33:44:78 (00:11:22:33:44:78) Destination: 00:11:22:33:44:78 (00:11:22:33:44:78) Source: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.150 (165.227.249.150), Dst: 165.227.249.155 (165.227.249.155) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 212 Identification: 0x41c8 (16840) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: UDP (0x11) Header checksum: 0xb957 [correct] Good: True Bad : False Source: 165.227.249.150 (165.227.249.150) Destination: 165.227.249.155 (165.227.249.155) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 192 Checksum: 0x50fa [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0x7412174E38E74088 Responder cookie: 0x0000000000000000 Next payload: Security Association (1) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 184 Security Association payload Next payload: Vendor ID (13) Length: 56 Domain of interpretation: IPSEC (1) Situation: IDENTITY (1) Proposal payload # 1 Next payload: NONE (0) Length: 44 Proposal number: 1 Protocol ID: ISAKMP (1) SPI size: 0 Number of transforms: 1 Transform payload # 1 Next payload: NONE (0) Length: 36 Transform number: 1 Transform ID: KEY_IKE (1) Encryption-Algorithm (1): AES-CBC (7) Key-Length (14): Key-Length (128) Hash-Algorithm (2): SHA (2) Group-Description (4): Alternate 1024-bit MODP group (2) Authentication-Method (3): PSK (1) Life-Type (11): Seconds (1) Life-Duration (12): Duration-Value (28800) Vendor ID payload Next payload: Vendor ID (13) Length: 20 Vendor ID: unknown vendor ID: 0x4A131C81070358455C5728F20E95452F Vendor ID payload Next payload: Vendor ID (13) Length: 20 Vendor ID: draft-ietf-ipsec-nat-t-ike-03 Vendor ID payload Next payload: Vendor ID (13) Length: 20 Vendor ID: draft-ietf-ipsec-nat-t-ike-02 Vendor ID payload Next payload: Vendor ID (13) Length: 20 Vendor ID: draft-ietf-ipsec-nat-t-ike-00 Vendor ID payload Next payload: NONE (0) Length: 20 Vendor ID: RFC 3706 Detecting Dead IKE Peers (DPD) 0000 00 11 22 33 44 78 00 0c 29 96 e1 fa 08 00 45 00 .."3Dx..).....E. 0010 00 d4 41 c8 00 00 80 11 b9 57 a5 e3 f9 96 a5 e3 ..A......W...... 0020 f9 9b 01 f4 01 f4 00 c0 50 fa 74 12 17 4e 38 e7 ........P.t..N8. 0030 40 88 00 00 00 00 00 00 00 00 01 10 02 00 00 00 @............... 0040 00 00 00 00 00 b8 0d 00 00 38 00 00 00 01 00 00 .........8...... 0050 00 01 00 00 00 2c 01 01 00 01 00 00 00 24 01 01 .....,.......$.. 0060 00 00 80 01 00 07 80 0e 00 80 80 02 00 02 80 04 ................ 0070 00 02 80 03 00 01 80 0b 00 01 80 0c 70 80 0d 00 ............p... 0080 00 14 4a 13 1c 81 07 03 58 45 5c 57 28 f2 0e 95 ..J.....XE\W(... 0090 45 2f 0d 00 00 14 7d 94 19 a6 53 10 ca 6f 2c 17 E/....}...S..o,. 00a0 9d 92 15 52 9d 56 0d 00 00 14 90 cb 80 91 3e bb ...R.V........>. 00b0 69 6e 08 63 81 b5 ec 42 7b 1f 0d 00 00 14 44 85 in.c...B{.....D. 00c0 15 2d 18 b6 bb cd 0b e8 a8 46 95 79 dd cc 00 00 .-.......F.y.... 00d0 00 14 af ca d7 13 68 a1 f1 c9 6b 86 96 fc 77 57 ......h...k...wW 00e0 01 00 .. Frame 2 (146 bytes on wire, 146 bytes captured) Arrival Time: Dec 14, 2007 12:50:12.639226000 Time delta from previous packet: 0.144250000 seconds Time since reference or first frame: 0.144250000 seconds Frame Number: 2 Packet Length: 146 bytes Capture Length: 146 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:11:22:33:44:78 (00:11:22:33:44:78), Dst: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa) Destination: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa) Source: 00:11:22:33:44:78 (00:11:22:33:44:78) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.155 (165.227.249.155), Dst: 165.227.249.150 (165.227.249.150) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 132 Identification: 0x0000 (0) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfb6f [correct] Good: True Bad : False Source: 165.227.249.155 (165.227.249.155) Destination: 165.227.249.150 (165.227.249.150) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 112 Checksum: 0xce7f [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0x7412174E38E74088 Responder cookie: 0x4655AB6EA2FE5C86 Next payload: Security Association (1) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 104 Security Association payload Next payload: Vendor ID (13) Length: 56 Domain of interpretation: IPSEC (1) Situation: IDENTITY (1) Proposal payload # 1 Next payload: NONE (0) Length: 44 Proposal number: 1 Protocol ID: ISAKMP (1) SPI size: 0 Number of transforms: 1 Transform payload # 1 Next payload: NONE (0) Length: 36 Transform number: 1 Transform ID: KEY_IKE (1) Encryption-Algorithm (1): AES-CBC (7) Key-Length (14): Key-Length (128) Hash-Algorithm (2): SHA (2) Group-Description (4): Alternate 1024-bit MODP group (2) Authentication-Method (3): PSK (1) Life-Type (11): Seconds (1) Life-Duration (12): Duration-Value (28800) Vendor ID payload Next payload: NONE (0) Length: 20 Vendor ID: unknown vendor ID: 0x7003CBC1097DBE9C2600BA6983BC8B35 0000 00 0c 29 96 e1 fa 00 11 22 33 44 78 08 00 45 00 ..)....."3Dx..E. 0010 00 84 00 00 40 00 40 11 fb 6f a5 e3 f9 9b a5 e3 ....@.@..o...... 0020 f9 96 01 f4 01 f4 00 70 ce 7f 74 12 17 4e 38 e7 .......p..t..N8. 0030 40 88 46 55 ab 6e a2 fe 5c 86 01 10 02 00 00 00 @.FU.n..\....... 0040 00 00 00 00 00 68 0d 00 00 38 00 00 00 01 00 00 .....h...8...... 0050 00 01 00 00 00 2c 01 01 00 01 00 00 00 24 01 01 .....,.......$.. 0060 00 00 80 01 00 07 80 0e 00 80 80 02 00 02 80 04 ................ 0070 00 02 80 03 00 01 80 0b 00 01 80 0c 70 80 00 00 ............p... 0080 00 14 70 03 cb c1 09 7d be 9c 26 00 ba 69 83 bc ..p....}..&..i.. 0090 8b 35 .5 Frame 3 (222 bytes on wire, 222 bytes captured) Arrival Time: Dec 14, 2007 12:50:12.659709000 Time delta from previous packet: 0.020483000 seconds Time since reference or first frame: 0.164733000 seconds Frame Number: 3 Packet Length: 222 bytes Capture Length: 222 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa), Dst: 00:11:22:33:44:78 (00:11:22:33:44:78) Destination: 00:11:22:33:44:78 (00:11:22:33:44:78) Source: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.150 (165.227.249.150), Dst: 165.227.249.155 (165.227.249.155) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 208 Identification: 0x41c9 (16841) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: UDP (0x11) Header checksum: 0xb95a [correct] Good: True Bad : False Source: 165.227.249.150 (165.227.249.150) Destination: 165.227.249.155 (165.227.249.155) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 188 Checksum: 0x630b [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0x7412174E38E74088 Responder cookie: 0x4655AB6EA2FE5C86 Next payload: Key Exchange (4) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 180 Key Exchange payload Next payload: Nonce (10) Length: 132 Key Exchange Data Nonce payload Next payload: NONE (0) Length: 20 Nonce Data 0000 00 11 22 33 44 78 00 0c 29 96 e1 fa 08 00 45 00 .."3Dx..).....E. 0010 00 d0 41 c9 00 00 80 11 b9 5a a5 e3 f9 96 a5 e3 ..A......Z...... 0020 f9 9b 01 f4 01 f4 00 bc 63 0b 74 12 17 4e 38 e7 ........c.t..N8. 0030 40 88 46 55 ab 6e a2 fe 5c 86 04 10 02 00 00 00 @.FU.n..\....... 0040 00 00 00 00 00 b4 0a 00 00 84 25 0f 57 f0 78 73 ..........%.W.xs 0050 77 64 13 58 4d 44 33 46 2f 31 43 70 f1 78 97 05 wd.XMD3F/1Cp.x.. 0060 53 15 53 39 14 4f b6 4a 6a 9a d1 82 4b 84 e7 98 S.S9.O.Jj...K... 0070 d9 59 f3 68 86 67 df 1c 9b 09 be 18 2f 2f 8e a4 .Y.h.g......//.. 0080 05 af ac 1c 46 a1 8b 51 3b 42 1f 79 94 88 ea 64 ....F..Q;B.y...d 0090 02 4f 15 13 2d 2f 42 1e 7a 0e e8 1b f4 1e 1e 1a .O..-/B.z....... 00a0 0e 9d d8 bc 47 89 3b b0 17 fb f8 8c 3b 22 1e 33 ....G.;.....;".3 00b0 47 e9 e0 c9 4e a3 f3 ac b2 46 06 f8 4d 91 be 85 G...N....F..M... 00c0 4e b8 f8 16 55 ee b2 fd 9c 61 00 00 00 14 e6 2e N...U....a...... 00d0 eb a0 35 b3 dd da c2 f5 be 57 9a 71 e1 5b ..5......W.q.[ Frame 4 (242 bytes on wire, 242 bytes captured) Arrival Time: Dec 14, 2007 12:50:12.871884000 Time delta from previous packet: 0.212175000 seconds Time since reference or first frame: 0.376908000 seconds Frame Number: 4 Packet Length: 242 bytes Capture Length: 242 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:11:22:33:44:78 (00:11:22:33:44:78), Dst: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa) Destination: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa) Source: 00:11:22:33:44:78 (00:11:22:33:44:78) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.155 (165.227.249.155), Dst: 165.227.249.150 (165.227.249.150) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 228 Identification: 0x0000 (0) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfb0f [correct] Good: True Bad : False Source: 165.227.249.155 (165.227.249.155) Destination: 165.227.249.150 (165.227.249.150) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 208 Checksum: 0x7a8d [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0x7412174E38E74088 Responder cookie: 0x4655AB6EA2FE5C86 Next payload: Key Exchange (4) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 200 Key Exchange payload Next payload: Nonce (10) Length: 132 Key Exchange Data Nonce payload Next payload: Vendor ID (13) Length: 20 Nonce Data Vendor ID payload Next payload: NONE (0) Length: 20 Vendor ID: unknown vendor ID: 0x7003CBC1097DBE9C2600BA6983BC8B35 0000 00 0c 29 96 e1 fa 00 11 22 33 44 78 08 00 45 00 ..)....."3Dx..E. 0010 00 e4 00 00 40 00 40 11 fb 0f a5 e3 f9 9b a5 e3 ....@.@......... 0020 f9 96 01 f4 01 f4 00 d0 7a 8d 74 12 17 4e 38 e7 ........z.t..N8. 0030 40 88 46 55 ab 6e a2 fe 5c 86 04 10 02 00 00 00 @.FU.n..\....... 0040 00 00 00 00 00 c8 0a 00 00 84 3b 7e a4 2e 66 84 ..........;~..f. 0050 00 3c 8c e3 14 ac 3e da 5f 6a b0 fb 2e 15 c5 38 .<....>._j.....8 0060 fa 43 bd 17 b0 25 c6 f5 07 b8 d4 31 4c 2c 13 69 .C...%.....1L,.i 0070 fc 10 78 15 b2 f9 eb 41 be a3 e9 d5 83 08 9e 1a ..x....A........ 0080 f9 5b 9d ae ed bb ad 72 85 a1 da 0a 86 3a 9a 5a .[.....r.....:.Z 0090 3c 9d 68 ea f7 dd a3 2b 81 45 ef d2 f8 63 80 34 <.h....+.E...c.4 00a0 50 7a ba d6 d2 c1 49 e9 5d 4d 4c e4 67 56 1a d4 Pz....I.]ML.gV.. 00b0 57 cb 38 fc 16 06 a8 ec 91 4e 0e 84 5d 8f 80 8b W.8......N..]... 00c0 54 5f 54 40 f8 f5 90 23 8e 28 0d 00 00 14 bd eb T_T@...#.(...... 00d0 88 44 4a 61 f1 60 47 10 f8 50 5d ea ea a9 00 00 .DJa.`G..P]..... 00e0 00 14 70 03 cb c1 09 7d be 9c 26 00 ba 69 83 bc ..p....}..&..i.. 00f0 8b 35 .5 Frame 5 (150 bytes on wire, 150 bytes captured) Arrival Time: Dec 14, 2007 12:50:12.906972000 Time delta from previous packet: 0.035088000 seconds Time since reference or first frame: 0.411996000 seconds Frame Number: 5 Packet Length: 150 bytes Capture Length: 150 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa), Dst: 00:11:22:33:44:78 (00:11:22:33:44:78) Destination: 00:11:22:33:44:78 (00:11:22:33:44:78) Source: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.150 (165.227.249.150), Dst: 165.227.249.155 (165.227.249.155) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 136 Identification: 0x41ca (16842) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: UDP (0x11) Header checksum: 0xb9a1 [correct] Good: True Bad : False Source: 165.227.249.150 (165.227.249.150) Destination: 165.227.249.155 (165.227.249.155) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 116 Checksum: 0x9f28 [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0x7412174E38E74088 Responder cookie: 0x4655AB6EA2FE5C86 Next payload: Identification (5) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 108 Encrypted payload (80 bytes) 0000 00 11 22 33 44 78 00 0c 29 96 e1 fa 08 00 45 00 .."3Dx..).....E. 0010 00 88 41 ca 00 00 80 11 b9 a1 a5 e3 f9 96 a5 e3 ..A............. 0020 f9 9b 01 f4 01 f4 00 74 9f 28 74 12 17 4e 38 e7 .......t.(t..N8. 0030 40 88 46 55 ab 6e a2 fe 5c 86 05 10 02 01 00 00 @.FU.n..\....... 0040 00 00 00 00 00 6c 53 bd 2a 21 6a 7e 7e 34 4c 4f .....lS.*!j~~4LO 0050 52 9e f6 da b0 66 2b 92 a6 7d 2b 19 a0 52 20 2b R....f+..}+..R + 0060 21 50 d2 36 ce 37 3f 71 da f5 06 d5 18 a4 16 ea !P.6.7?q........ 0070 46 9e c4 b9 a2 84 ea f1 33 91 18 3f 3a 72 8a 9c F.......3..?:r.. 0080 18 f5 16 c2 bb ee 06 08 aa 6d d4 3f 67 5c a9 89 .........m.?g\.. 0090 c7 1a 56 81 59 ea ..V.Y. Frame 6 (118 bytes on wire, 118 bytes captured) Arrival Time: Dec 14, 2007 12:50:12.977111000 Time delta from previous packet: 0.070139000 seconds Time since reference or first frame: 0.482135000 seconds Frame Number: 6 Packet Length: 118 bytes Capture Length: 118 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:11:22:33:44:78 (00:11:22:33:44:78), Dst: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa) Destination: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa) Source: 00:11:22:33:44:78 (00:11:22:33:44:78) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.155 (165.227.249.155), Dst: 165.227.249.150 (165.227.249.150) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 104 Identification: 0x0000 (0) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfb8b [correct] Good: True Bad : False Source: 165.227.249.155 (165.227.249.155) Destination: 165.227.249.150 (165.227.249.150) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 84 Checksum: 0x5a35 [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0x7412174E38E74088 Responder cookie: 0x4655AB6EA2FE5C86 Next payload: Identification (5) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 76 Encrypted payload (48 bytes) 0000 00 0c 29 96 e1 fa 00 11 22 33 44 78 08 00 45 00 ..)....."3Dx..E. 0010 00 68 00 00 40 00 40 11 fb 8b a5 e3 f9 9b a5 e3 .h..@.@......... 0020 f9 96 01 f4 01 f4 00 54 5a 35 74 12 17 4e 38 e7 .......TZ5t..N8. 0030 40 88 46 55 ab 6e a2 fe 5c 86 05 10 02 01 00 00 @.FU.n..\....... 0040 00 00 00 00 00 4c a4 e3 1a 29 09 31 3c 29 72 5c .....L...).1<)r\ 0050 4a 75 9a 06 e7 2e d9 7e 0e fa 0f 94 e9 aa de 80 Ju.....~........ 0060 09 4c 1c d9 06 e9 ee f5 7a f4 b6 46 ac 27 3a cf .L......z..F.':. 0070 de e8 b7 2c 97 c6 ...,.. Frame 7 (134 bytes on wire, 134 bytes captured) Arrival Time: Dec 14, 2007 12:50:12.977113000 Time delta from previous packet: 0.000002000 seconds Time since reference or first frame: 0.482137000 seconds Frame Number: 7 Packet Length: 134 bytes Capture Length: 134 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:11:22:33:44:78 (00:11:22:33:44:78), Dst: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa) Destination: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa) Source: 00:11:22:33:44:78 (00:11:22:33:44:78) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.155 (165.227.249.155), Dst: 165.227.249.150 (165.227.249.150) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 120 Identification: 0x0000 (0) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfb7b [correct] Good: True Bad : False Source: 165.227.249.155 (165.227.249.155) Destination: 165.227.249.150 (165.227.249.150) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 100 Checksum: 0x2f29 [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0x7412174E38E74088 Responder cookie: 0x4655AB6EA2FE5C86 Next payload: Hash (8) Version: 1.0 Exchange type: Informational (5) Flags .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0xE0314297 Length: 92 Encrypted payload (64 bytes) 0000 00 0c 29 96 e1 fa 00 11 22 33 44 78 08 00 45 00 ..)....."3Dx..E. 0010 00 78 00 00 40 00 40 11 fb 7b a5 e3 f9 9b a5 e3 .x..@.@..{...... 0020 f9 96 01 f4 01 f4 00 64 2f 29 74 12 17 4e 38 e7 .......d/)t..N8. 0030 40 88 46 55 ab 6e a2 fe 5c 86 08 10 05 01 e0 31 @.FU.n..\......1 0040 42 97 00 00 00 5c 7b 2d 5e 33 19 00 cc 5a 7c e5 B....\{-^3...Z|. 0050 f5 94 cf 90 fb cf 06 da cb fc 62 e9 08 45 7b 85 ..........b..E{. 0060 eb a3 35 e5 32 95 b9 01 2f fc 85 90 ae f9 af d7 ..5.2.../....... 0070 d7 6f 76 85 bf 54 a4 7e f2 c1 21 d6 0c 6b a7 67 .ov..T.~..!..k.g 0080 48 e6 cd d1 fe 40 H....@ Frame 8 (342 bytes on wire, 342 bytes captured) Arrival Time: Dec 14, 2007 12:50:12.998808000 Time delta from previous packet: 0.021695000 seconds Time since reference or first frame: 0.503832000 seconds Frame Number: 8 Packet Length: 342 bytes Capture Length: 342 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa), Dst: 00:11:22:33:44:78 (00:11:22:33:44:78) Destination: 00:11:22:33:44:78 (00:11:22:33:44:78) Source: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.150 (165.227.249.150), Dst: 165.227.249.155 (165.227.249.155) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 328 Identification: 0x41cb (16843) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: UDP (0x11) Header checksum: 0xb8e0 [correct] Good: True Bad : False Source: 165.227.249.150 (165.227.249.150) Destination: 165.227.249.155 (165.227.249.155) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 308 Checksum: 0xe7db [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0x7412174E38E74088 Responder cookie: 0x4655AB6EA2FE5C86 Next payload: Hash (8) Version: 1.0 Exchange type: Quick Mode (32) Flags .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0xD24D0ABA Length: 300 Encrypted payload (272 bytes) 0000 00 11 22 33 44 78 00 0c 29 96 e1 fa 08 00 45 00 .."3Dx..).....E. 0010 01 48 41 cb 00 00 80 11 b8 e0 a5 e3 f9 96 a5 e3 .HA............. 0020 f9 9b 01 f4 01 f4 01 34 e7 db 74 12 17 4e 38 e7 .......4..t..N8. 0030 40 88 46 55 ab 6e a2 fe 5c 86 08 10 20 01 d2 4d @.FU.n..\... ..M 0040 0a ba 00 00 01 2c 29 c4 4b 55 4e d0 2c af dc f1 .....,).KUN.,... 0050 71 2e e6 2c dd 82 fc 76 a4 f0 78 4d f7 0e 3e 81 q..,...v..xM..>. 0060 fc 15 67 06 d3 2e af 42 86 82 5f be 6c d7 09 12 ..g....B.._.l... 0070 ad 5c d3 16 03 04 2e d0 ce 46 51 2f 37 e5 46 06 .\.......FQ/7.F. 0080 46 36 2e ba 77 23 c8 48 ff ec ef 20 e1 70 17 1c F6..w#.H... .p.. 0090 7a b7 08 c7 9a 20 b2 c4 f7 17 42 44 23 59 8f 72 z.... ....BD#Y.r 00a0 42 8d 5d 2f 01 a8 63 9f 89 56 88 52 61 fa dd c9 B.]/..c..V.Ra... 00b0 3c 0f 8d 24 5d 37 ff 56 29 c2 fe 16 41 b7 2a ee <..$]7.V)...A.*. 00c0 75 ea a4 fb 38 7d 33 03 ae eb a9 0f 4a 4d 07 16 u...8}3.....JM.. 00d0 36 9d d2 0d 5e 79 b2 53 e3 27 90 8c d9 1d b7 ae 6...^y.S.'...... 00e0 88 43 a5 e3 f0 29 e6 8c f2 3c 97 0f e6 4b 60 37 .C...)...<...K`7 00f0 74 82 c1 da 47 33 c2 fe 7d 1d f5 d3 c0 51 4d 04 t...G3..}....QM. 0100 d0 4e f2 e7 5c 7b e3 42 d0 05 2e 58 74 08 17 5c .N..\{.B...Xt..\ 0110 48 92 08 ae f3 cf e4 df 78 63 d9 36 f8 2d c7 f9 H.......xc.6.-.. 0120 0d 5b 69 45 c4 c5 6d 53 53 f3 23 95 6d 86 7b 80 .[iE..mSS.#.m.{. 0130 f0 1b f9 bf b9 4e 9b 71 dd 90 25 7b 40 3d 62 8c .....N.q..%{@=b. 0140 d5 33 34 a0 26 52 d7 bd 8d e2 6c 31 c7 f3 e6 4f .34.&R....l1...O 0150 a4 a3 57 1b 44 c3 ..W.D. Frame 9 (342 bytes on wire, 342 bytes captured) Arrival Time: Dec 14, 2007 12:50:13.376333000 Time delta from previous packet: 0.377525000 seconds Time since reference or first frame: 0.881357000 seconds Frame Number: 9 Packet Length: 342 bytes Capture Length: 342 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:11:22:33:44:78 (00:11:22:33:44:78), Dst: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa) Destination: 00:0c:29:96:e1:fa (00:0c:29:96:e1:fa) Source: 00:11:22:33:44:78 (00:11:22:33:44:78) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.155 (165.227.249.155), Dst: 165.227.249.150 (165.227.249.150) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 328 Identification: 0x0000 (0) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xfaab [correct] Good: True Bad : False Source: 165.227.249.155 (165.227.249.155) Destination: 165.227.249.150 (165.227.249.150) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 308 Checksum: 0x783d [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0x7412174E38E74088 Responder cookie: 0x4655AB6EA2FE5C86 Next payload: Hash (8) Version: 1.0 Exchange type: Quick Mode (32) Flags .... ...1 = Encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0xD24D0ABA Length: 300 Encrypted payload (272 bytes) 0000 00 0c 29 96 e1 fa 00 11 22 33 44 78 08 00 45 00 ..)....."3Dx..E. 0010 01 48 00 00 40 00 40 11 fa ab a5 e3 f9 9b a5 e3 .H..@.@......... 0020 f9 96 01 f4 01 f4 01 34 78 3d 74 12 17 4e 38 e7 .......4x=t..N8. 0030 40 88 46 55 ab 6e a2 fe 5c 86 08 10 20 01 d2 4d @.FU.n..\... ..M 0040 0a ba 00 00 01 2c 90 f7 ea 55 4d dc 3f 67 de d5 .....,...UM.?g.. 0050 7e cb a1 b0 43 ad f3 3e b5 0f 67 71 82 35 21 8c ~...C..>..gq.5!. 0060 23 ad 1b a7 83 19 fa 26 36 60 bc 0d aa d9 52 06 #......&6`....R. 0070 63 c9 1b a4 f0 7a 85 88 df c4 5f b9 9b 06 f6 e8 c....z...._..... 0080 5b bf 91 4a f4 13 24 79 02 88 ff 6e b7 1e a7 15 [..J..$y...n.... 0090 61 a2 57 17 b9 45 24 0a 71 1a b4 33 07 18 94 e3 a.W..E$.q..3.... 00a0 50 25 ad d6 02 fd ca 8b d9 20 05 62 e7 73 bc c9 P%....... .b.s.. 00b0 3a de 3d df ac 39 84 af 5f 0d 82 cc 38 2b 60 b7 :.=..9.._...8+`. 00c0 81 32 fd b8 43 94 dd 69 ea a5 d4 8f 66 3e 74 ed .2..C..i....f>t. 00d0 1f 13 3c 4c c2 73 08 47 e1 1f ba 7a 6b 63 e6 23 .. 00f0 09 7b fe dd 5b c0 72 9b 7d e3 98 6b 9b 19 9e 2b .{..[.r.}..k...+ 0100 62 09 45 6b c9 9a 84 ee d5 c7 8f 14 7e 63 90 23 b.Ek........~c.# 0110 44 34 0f ce ec 69 e1 e2 dc b2 30 11 91 86 bc 5c D4...i....0....\ 0120 ab 8d 3a 97 05 a6 af 32 2f 47 74 12 59 f8 55 91 ..:....2/Gt.Y.U. 0130 7c 5c 09 c1 54 92 81 ad ed c3 d1 bd 04 59 02 1a |\..T........Y.. 0140 50 06 9d c8 fb db 4c 15 a9 e0 c6 f2 6d c0 bb 7b P.....L.....m..{ 0150 a2 29 5c dc 72 13 4b 7e 19 6b 84 8c 3d 8c e5 4b .)\.r.K~.k..=..K 0160 d8 f1 e1 db cc dd 75 ea dc b8 52 0c c5 e1 f8 05 ......u...R..... 0170 47 69 0d 10 49 54 9e 5a fe 5e 0e be 85 8b 0e 43 Gi..IT.Z.^.....C 0180 eb 9e e1 b2 36 25 d6 7d fa 6a 3c 4a fb 79 01 44 ....6%.}.j