Frame 57 (486 bytes on wire, 486 bytes captured) Arrival Time: Jun 18, 2008 21:33:51.330359000 [Time delta from previous captured frame: 0.026505000 seconds] [Time delta from previous displayed frame: 0.026505000 seconds] [Time since reference or first frame: 13.199918000 seconds] Frame Number: 57 Frame Length: 486 bytes Capture Length: 486 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] [Coloring Rule Name: UDP] [Coloring Rule String: udp] Ethernet II, Src: 00:1c:10:05:44:b2 (00:1c:10:05:44:b2), Dst: 00:1c:b3:c5:73:02 (00:1c:b3:c5:73:02) Destination: 00:1c:b3:c5:73:02 (00:1c:b3:c5:73:02) Address: 00:1c:b3:c5:73:02 (00:1c:b3:c5:73:02) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:1c:10:05:44:b2 (00:1c:10:05:44:b2) Address: 00:1c:10:05:44:b2 (00:1c:10:05:44:b2) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 64.1.215.240 (64.1.215.240), Dst: 192.168.1.100 (192.168.1.100) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x20 (DSCP 0x08: Class Selector 1; ECN: 0x00) 0010 00.. = Differentiated Services Codepoint: Class Selector 1 (0x08) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 472 Identification: 0x2f14 (12052) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 241 Protocol: UDP (0x11) Header checksum: 0xbee2 [correct] [Good: True] [Bad : False] Source: 64.1.215.240 (64.1.215.240) Destination: 192.168.1.100 (192.168.1.100) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 452 Checksum: 0x3e8a [correct] [Good Checksum: True] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: 0F344B6499976FA2 Responder cookie: 0600B3CB05BB6BF7 Next payload: Security Association (1) Version: 1.0 Exchange type: Aggressive (4) Flags: 0x00 .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 444 Security Association payload Next payload: Key Exchange (4) Payload length: 60 Domain of interpretation: IPSEC (1) Situation: IDENTITY (1) Proposal payload # 1 Next payload: NONE (0) Payload length: 48 Proposal number: 1 Protocol ID: ISAKMP (1) SPI Size: 0 Proposal transforms: 1 Transform payload # 5 Next payload: NONE (0) Payload length: 40 Transform number: 5 Transform ID: KEY_IKE (1) Encryption-Algorithm (1): AES-CBC (7) Key-Length (14): Key-Length (128) Hash-Algorithm (2): SHA (2) Group-Description (4): Alternate 1024-bit MODP group (2) Authentication-Method (3): XAUTHInitPreShared (65001) Life-Type (11): Seconds (1) Life-Duration (12): Duration-Value (2147483) Key Exchange payload Next payload: Nonce (10) Payload length: 132 Key Exchange Data (128 bytes / 1024 bits) Nonce payload Next payload: Identification (5) Payload length: 24 Nonce Data Identification payload Next payload: Hash (8) Payload length: 12 ID type: 1 ID type: IPV4_ADDR (1) Protocol ID: UDP (17) Port: Unused Identification data: 64.1.215.240 Hash payload Next payload: Vendor ID (13) Payload length: 24 Hash Data Vendor ID: CISCO-UNITY-1.0 Next payload: Vendor ID (13) Payload length: 20 Vendor ID: CISCO-UNITY-1.0 Vendor ID: draft-beaulieu-ike-xauth-02.txt Next payload: Vendor ID (13) Payload length: 12 Vendor ID: draft-beaulieu-ike-xauth-02.txt Vendor ID: RFC 3706 Detecting Dead IKE Peers (DPD) Next payload: Vendor ID (13) Payload length: 20 Vendor ID: RFC 3706 Detecting Dead IKE Peers (DPD) Vendor ID: draft-ietf-ipsec-nat-t-ike-02\n Next payload: NAT-D (draft-ietf-ipsec-nat-t-ike-01 to 03) (130) Payload length: 20 Vendor ID: draft-ietf-ipsec-nat-t-ike-02\n NAT-D (draft-ietf-ipsec-nat-t-ike-01 to 03) payload Next payload: NAT-D (draft-ietf-ipsec-nat-t-ike-01 to 03) (130) Payload length: 24 Hash of address and port: B9EBD8A7786051B3AC0068A3B3A4479DA46D3EA5 NAT-D (draft-ietf-ipsec-nat-t-ike-01 to 03) payload Next payload: Vendor ID (13) Payload length: 24 Hash of address and port: E762BB763C812F8AFD986F5235BAF2D2FF3DCFE4 Vendor ID: Microsoft L2TP/IPSec VPN Client Next payload: Vendor ID (13) Payload length: 24 Vendor ID: Microsoft L2TP/IPSec VPN Client Vendor ID: CISCO-CONCENTRATOR Next payload: NONE (0) Payload length: 20 Vendor ID: CISCO-CONCENTRATOR 0000 00 1c b3 c5 73 02 00 1c 10 05 44 b2 08 00 45 20 ....s.....D...E 0010 01 d8 2f 14 00 00 f1 11 be e2 40 01 d7 f0 c0 a8 ../.......@..... 0020 01 64 01 f4 01 f4 01 c4 3e 8a 0f 34 4b 64 99 97 .d......>..4Kd.. 0030 6f a2 06 00 b3 cb 05 bb 6b f7 01 10 04 00 00 00 o.......k....... 0040 00 00 00 00 01 bc 04 00 00 3c 00 00 00 01 00 00 .........<...... 0050 00 01 00 00 00 30 01 01 00 01 00 00 00 28 05 01 .....0.......(.. 0060 00 00 80 01 00 07 80 0e 00 80 80 02 00 02 80 04 ................ 0070 00 02 80 03 fd e9 80 0b 00 01 00 0c 00 04 00 20 ............... 0080 c4 9b 0a 00 00 84 1c 80 3e ac 5a 06 fa 2e 24 a3 ........>.Z...$. 0090 f3 98 6f f7 ed 13 eb 40 97 26 e3 c3 8f 1c 8d b1 ..o....@.&...... 00a0 5c 1d bd b9 e7 98 ca cf 5c ac ee a9 93 ac b1 f8 \.......\....... 00b0 c2 d5 f9 e7 a0 e9 ad 4c 0a a8 fd 45 89 2c d3 f5 .......L...E.,.. 00c0 a1 25 8a 34 23 8c af d6 96 c2 29 63 14 8a 07 88 .%.4#.....)c.... 00d0 ae c1 32 25 8a 26 61 fb ad 9d 74 53 9e 4e e4 ca ..2%.&a...tS.N.. 00e0 b4 42 07 0b 10 db 2b 16 6e 24 bb a9 b7 fa cc 92 .B....+.n$...... 00f0 aa 51 33 26 3c b3 3c da a6 2b e6 ff 48 e4 6f 1e .Q3&<.<..+..H.o. 0100 99 ac 59 b0 81 f8 05 00 00 18 b8 eb d9 a3 31 9b ..Y...........1. 0110 85 bf a3 91 53 8a 5b 27 43 7f 9a e8 c7 ce 08 00 ....S.['C....... 0120 00 0c 01 11 00 00 40 01 d7 f0 0d 00 00 18 bf 49 ......@........I 0130 ae e5 92 eb 7b 46 88 16 d4 62 a8 08 f5 c6 68 c4 ....{F...b....h. 0140 73 fb 0d 00 00 14 12 f5 f2 8c 45 71 68 a9 70 2d s.........Eqh.p- 0150 9f e2 74 cc 01 00 0d 00 00 0c 09 00 26 89 df d6 ..t.........&... 0160 b7 12 0d 00 00 14 af ca d7 13 68 a1 f1 c9 6b 86 ..........h...k. 0170 96 fc 77 57 01 00 82 00 00 14 90 cb 80 91 3e bb ..wW..........>. 0180 69 6e 08 63 81 b5 ec 42 7b 1f 82 00 00 18 b9 eb in.c...B{....... 0190 d8 a7 78 60 51 b3 ac 00 68 a3 b3 a4 47 9d a4 6d ..x`Q...h...G..m 01a0 3e a5 0d 00 00 18 e7 62 bb 76 3c 81 2f 8a fd 98 >......b.v<./... 01b0 6f 52 35 ba f2 d2 ff 3d cf e4 0d 00 00 18 40 48 oR5....=......@H 01c0 b7 d5 6e bc e8 85 25 e7 de 7f 00 d6 c2 d3 c0 00 ..n...%......... 01d0 00 00 00 00 00 14 1f 07 f7 0e aa 65 14 d3 b0 fa ...........e.... 01e0 96 54 2a 50 01 00 .T*P..