Frame 1 (410 bytes on wire, 410 bytes captured) Arrival Time: Nov 29, 2006 11:24:45.493645000 Time delta from previous packet: 0.000000000 seconds Time since reference or first frame: 0.000000000 seconds Frame Number: 1 Packet Length: 410 bytes Capture Length: 410 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:0c:29:66:91:21 (00:0c:29:66:91:21), Dst: 00:0c:29:96:d4:43 (00:0c:29:96:d4:43) Destination: 00:0c:29:96:d4:43 (00:0c:29:96:d4:43) Source: 00:0c:29:66:91:21 (00:0c:29:66:91:21) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.119 (165.227.249.119), Dst: 165.227.249.134 (165.227.249.134) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 396 Identification: 0x1327 (4903) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: UDP (0x11) Header checksum: 0xe774 [correct] Good: True Bad : False Source: 165.227.249.119 (165.227.249.119) Destination: 165.227.249.134 (165.227.249.134) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 376 Checksum: 0x204e [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0x6ACEA6790249C7F2 Responder cookie: 0x0000000000000000 Next payload: Security Association (33) Version: 2.0 Exchange type: IKE_SA_INIT (34) Flags .... 1... = Initiator ...0 .... = ..0. .... = Request Message ID: 0x00000000 Length: 368 Security Association payload Next payload: Key Exchange (34) 0... .... = Not critical Length: 72 Proposal payload # 1 Next payload: RESERVED (0) 0... .... = Not critical Length: 68 Proposal number: 1 Protocol ID: ISAKMP (1) SPI size: 0 Number of transforms: 6 Transform payload Next payload: Transform (3) 0... .... = Not critical Length: 12 Transform type: Encryption Algorithm (ENCR) (1) Transform ID: ENCR_AES_CBC (12) PRIVATE USE (14): Key-Length (128) Transform payload Next payload: Transform (3) 0... .... = Not critical Length: 12 Transform type: Encryption Algorithm (ENCR) (1) Transform ID: ENCR_AES_CBC (12) PRIVATE USE (14): Key-Length (192) Transform payload Next payload: Transform (3) 0... .... = Not critical Length: 12 Transform type: Encryption Algorithm (ENCR) (1) Transform ID: ENCR_AES_CBC (12) PRIVATE USE (14): Key-Length (256) Transform payload Next payload: Transform (3) 0... .... = Not critical Length: 8 Transform type: Pseudo-random Function (PRF) (2) Transform ID: PRF_HMAC_SHA1 (2) Transform payload Next payload: Transform (3) 0... .... = Not critical Length: 8 Transform type: Integrity Algorithm (INTEG) (3) Transform ID: AUTH_HMAC_SHA1_96 (2) Transform payload Next payload: RESERVED (0) 0... .... = Not critical Length: 8 Transform type: Diffie-Hellman Group (D-H) (4) Transform ID: Group 2 - 1024 Bit MODP (2) Key Exchange payload Next payload: Nonce (40) 0... .... = Not critical Length: 136 DH Group #: 2 Key Exchange Data Nonce payload Next payload: Notification (41) 0... .... = Not critical Length: 36 Nonce Data Notification payload Next payload: Notification (41) 0... .... = Not critical Length: 28 Protocol ID: RESERVED (0) SPI size: 0 Message type: NAT_DETECTION_SOURCE_IP (16388) Notification Data Notification payload Next payload: Vendor ID (43) 0... .... = Not critical Length: 28 Protocol ID: RESERVED (0) SPI size: 0 Message type: NAT_DETECTION_DESTINATION_IP (16389) Notification Data Vendor ID payload Next payload: Vendor ID (43) 0... .... = Not critical Length: 20 Vendor ID: unknown vendor ID: 0xF758F22668750F03B08DF6EBE1D00300 Vendor ID payload Next payload: RESERVED (0) 0... .... = Not critical Length: 20 Vendor ID: unknown vendor ID: 0x4A131C81070358455C5728F20E95452F 0000 00 0c 29 96 d4 43 00 0c 29 66 91 21 08 00 45 00 ..)..C..)f.!..E. 0010 01 8c 13 27 00 00 80 11 e7 74 a5 e3 f9 77 a5 e3 ...'.....t...w.. 0020 f9 86 01 f4 01 f4 01 78 20 4e 6a ce a6 79 02 49 .......x Nj..y.I 0030 c7 f2 00 00 00 00 00 00 00 00 21 20 22 08 00 00 ..........! "... 0040 00 00 00 00 01 70 22 00 00 48 00 00 00 44 01 01 .....p"..H...D.. 0050 00 06 03 00 00 0c 01 00 00 0c 80 0e 00 80 03 00 ................ 0060 00 0c 01 00 00 0c 80 0e 00 c0 03 00 00 0c 01 00 ................ 0070 00 0c 80 0e 01 00 03 00 00 08 02 00 00 02 03 00 ................ 0080 00 08 03 00 00 02 00 00 00 08 04 00 00 02 28 00 ..............(. 0090 00 88 00 02 00 00 be 5a 27 e9 b4 13 09 49 9a f8 .......Z'....I.. 00a0 31 d8 39 1b 01 da 36 e5 4a b5 b7 7b de 7b db a4 1.9...6.J..{.{.. 00b0 9f 7b ef 20 7b 59 99 eb 73 c0 e1 49 21 ae ad 1a .{. {Y..s..I!... 00c0 10 bb 1f fa 2d eb 76 29 5c 87 17 25 e4 1a e8 74 ....-.v)\..%...t 00d0 74 1c 76 c5 de 9f 4c 67 4c 09 19 04 1b 99 39 87 t.v...LgL.....9. 00e0 e9 b4 26 9e 2e 1e 2f 01 cb 90 7c de 9b a7 e6 6b ..&.../...|....k 00f0 69 ea 82 d2 af 92 b9 bf 39 c3 f1 38 26 29 0c c7 i.......9..8&).. 0100 a1 a7 42 1a dd c0 c4 58 59 d6 e0 68 2f 05 2e ef ..B....XY..h/... 0110 c1 1d 64 68 94 d3 29 00 00 24 a3 87 f9 28 a5 24 ..dh..)..$...(.$ 0120 61 f3 be 6a 3e 75 05 1c 8e 8d 22 1b 5d f6 91 87 a..j>u....".]... 0130 93 05 8e bd 4a 50 33 3e 92 72 29 00 00 1c 00 00 ....JP3>.r)..... 0140 40 04 78 f0 2c 2b 0b b9 81 c5 1b 6c 83 5a 3a 2e @.x.,+.....l.Z:. 0150 c3 a0 93 f4 a4 10 2b 00 00 1c 00 00 40 05 0a e3 ......+.....@... 0160 82 7e 61 17 10 74 85 50 f5 53 f7 a3 2c b0 e4 39 .~a..t.P.S..,..9 0170 ca 6e 2b 00 00 14 f7 58 f2 26 68 75 0f 03 b0 8d .n+....X.&hu.... 0180 f6 eb e1 d0 03 00 00 00 00 14 4a 13 1c 81 07 03 ..........J..... 0190 58 45 5c 57 28 f2 0e 95 45 2f XE\W(...E/ Frame 2 (322 bytes on wire, 322 bytes captured) Arrival Time: Nov 29, 2006 11:24:45.643187000 Time delta from previous packet: 0.149542000 seconds Time since reference or first frame: 0.149542000 seconds Frame Number: 2 Packet Length: 322 bytes Capture Length: 322 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:0c:29:96:d4:43 (00:0c:29:96:d4:43), Dst: 00:0c:29:66:91:21 (00:0c:29:66:91:21) Destination: 00:0c:29:66:91:21 (00:0c:29:66:91:21) Source: 00:0c:29:96:d4:43 (00:0c:29:96:d4:43) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.134 (165.227.249.134), Dst: 165.227.249.119 (165.227.249.119) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 308 Identification: 0x4b00 (19200) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xeff3 [correct] Good: True Bad : False Source: 165.227.249.134 (165.227.249.134) Destination: 165.227.249.119 (165.227.249.119) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 288 Checksum: 0x4fcd [correct] Internet Security Association and Key Management Protocol Initiator cookie: 0x6ACEA6790249C7F2 Responder cookie: 0x9E71E01BD6FE4577 Next payload: Security Association (33) Version: 2.0 Exchange type: IKE_SA_INIT (34) Flags .... 0... = Responder ...0 .... = ..1. .... = Response Message ID: 0x00000000 Length: 280 Security Association payload Next payload: Key Exchange (34) 0... .... = Not critical Length: 48 Proposal payload # 1 Next payload: RESERVED (0) 0... .... = Not critical Length: 44 Proposal number: 1 Protocol ID: ISAKMP (1) SPI size: 0 Number of transforms: 4 Transform payload Next payload: Transform (3) 0... .... = Not critical Length: 12 Transform type: Encryption Algorithm (ENCR) (1) Transform ID: ENCR_AES_CBC (12) PRIVATE USE (14): Key-Length (128) Transform payload Next payload: Transform (3) 0... .... = Not critical Length: 8 Transform type: Integrity Algorithm (INTEG) (3) Transform ID: AUTH_HMAC_SHA1_96 (2) Transform payload Next payload: Transform (3) 0... .... = Not critical Length: 8 Transform type: Pseudo-random Function (PRF) (2) Transform ID: PRF_HMAC_SHA1 (2) Transform payload Next payload: RESERVED (0) 0... .... = Not critical Length: 8 Transform type: Diffie-Hellman Group (D-H) (4) Transform ID: Group 2 - 1024 Bit MODP (2) Key Exchange payload Next payload: Nonce (40) 0... .... = Not critical Length: 136 DH Group #: 2 Key Exchange Data Nonce payload Next payload: RESERVED (0) 0... .... = Not critical Length: 68 Nonce Data 0000 00 0c 29 66 91 21 00 0c 29 96 d4 43 08 00 45 00 ..)f.!..)..C..E. 0010 01 34 4b 00 00 00 40 11 ef f3 a5 e3 f9 86 a5 e3 .4K...@......... 0020 f9 77 01 f4 01 f4 01 20 4f cd 6a ce a6 79 02 49 .w..... O.j..y.I 0030 c7 f2 9e 71 e0 1b d6 fe 45 77 21 20 22 20 00 00 ...q....Ew! " .. 0040 00 00 00 00 01 18 22 00 00 30 00 00 00 2c 01 01 ......"..0...,.. 0050 00 04 03 00 00 0c 01 00 00 0c 80 0e 00 80 03 00 ................ 0060 00 08 03 00 00 02 03 00 00 08 02 00 00 02 00 00 ................ 0070 00 08 04 00 00 02 28 00 00 88 00 02 00 00 3c 2f ......(........- 0060 6d 69 64 83 e8 3b 2b 10 24 d7 09 01 91 be dc 54 mid..;+.$......T 0070 80 0f fa bd 14 a4 98 56 e1 f0 a9 34 3d 86 8a e9 .......V...4=... 0080 1f ae c8 1f 65 10 ....e. Frame 11 (134 bytes on wire, 134 bytes captured) Arrival Time: Nov 29, 2006 11:24:47.956509000 Time delta from previous packet: 0.765043000 seconds Time since reference or first frame: 2.462864000 seconds Frame Number: 11 Packet Length: 134 bytes Capture Length: 134 bytes Protocols in frame: eth:ip:esp:data Ethernet II, Src: 00:0c:29:66:91:21 (00:0c:29:66:91:21), Dst: 00:0c:29:96:d4:43 (00:0c:29:96:d4:43) Destination: 00:0c:29:96:d4:43 (00:0c:29:96:d4:43) Source: 00:0c:29:66:91:21 (00:0c:29:66:91:21) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.119 (165.227.249.119), Dst: 165.227.249.134 (165.227.249.134) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 120 Identification: 0x001d (29) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 240 Protocol: ESP (0x32) Header checksum: 0x8b71 [correct] Good: True Bad : False Source: 165.227.249.119 (165.227.249.119) Destination: 165.227.249.134 (165.227.249.134) Encapsulating Security Payload SPI: 0x12301e33 Sequence: 4 Data (92 bytes) 0000 00 0c 29 96 d4 43 00 0c 29 66 91 21 08 00 45 00 ..)..C..)f.!..E. 0010 00 78 00 1d 00 00 f0 32 8b 71 a5 e3 f9 77 a5 e3 .x.....2.q...w.. 0020 f9 86 12 30 1e 33 00 00 00 04 77 52 18 e6 6b fb ...0.3....wR..k. 0030 5a fe c7 91 fb 0b 71 8c 20 78 e7 34 4a 22 51 5a Z.....q. x.4J"QZ 0040 8b 58 53 d5 c0 31 1b a0 b4 eb c4 ce 04 25 76 a9 .XS..1.......%v. 0050 c2 f9 92 bd fd 64 de d0 3f 6a 56 38 6d 58 90 8d .....d..?jV8mX.. 0060 71 bd 67 6c 0b 62 fb e7 23 13 cc 67 77 2b 8f 77 q.gl.b..#..gw+.w 0070 ba 70 97 7a a3 7a 13 67 72 da 9c 60 bb da d9 af .p.z.z.gr..`.... 0080 c4 7b 5e 04 ab bd .{^... Frame 12 (134 bytes on wire, 134 bytes captured) Arrival Time: Nov 29, 2006 11:24:47.962477000 Time delta from previous packet: 0.005968000 seconds Time since reference or first frame: 2.468832000 seconds Frame Number: 12 Packet Length: 134 bytes Capture Length: 134 bytes Protocols in frame: eth:ip:esp:data Ethernet II, Src: 00:0c:29:96:d4:43 (00:0c:29:96:d4:43), Dst: 00:0c:29:66:91:21 (00:0c:29:66:91:21) Destination: 00:0c:29:66:91:21 (00:0c:29:66:91:21) Source: 00:0c:29:96:d4:43 (00:0c:29:96:d4:43) Type: IP (0x0800) Internet Protocol, Src: 165.227.249.134 (165.227.249.134), Dst: 165.227.249.119 (165.227.249.119) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 120 Identification: 0x5400 (21504) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 127 Protocol: ESP (0x32) Header checksum: 0xa88e [correct] Good: True Bad : False Source: 165.227.249.134 (165.227.249.134) Destination: 165.227.249.119 (165.227.249.119) Encapsulating Security Payload SPI: 0x73d71d8b Sequence: 4 Data (92 bytes) 0000 00 0c 29 66 91 21 00 0c 29 96 d4 43 08 00 45 00 ..)f.!..)..C..E. 0010 00 78 54 00 00 00 7f 32 a8 8e a5 e3 f9 86 a5 e3 .xT....2........ 0020 f9 77 73 d7 1d 8b 00 00 00 04 28 f4 65 04 3c a4 .ws.......(.e.<. 0030 98 6b 0a e7 54 02 01 cc 71 d4 36 1c e1 a8 b8 07 .k..T...q.6..... 0040 4f 0f 5d be 10 d7 79 10 a4 00 bf 11 72 0c d4 2d O.]...y.....r..- 0050 d2 14 50 18 e6 e9 fa 01 e4 c2 fd 53 59 90 67 1d ..P........SY.g. 0060 f6 a2 21 e5 08 5e 2b c5 29 2d 05 2f 2b b2 42 b4 ..!..^+.)-./+.B. 0070 10 48 ef f3 00 a5 07 66 34 65 bb 40 93 64 f2 00 .H.....f4e.@.d.. 0080 2e c8 b4 dc e2 42 .....B