<div>Hello,</div>
<div> </div>
<div>I have some improvements but I still cannot make the connection.. </div>
<div> </div>
<div>Here is the summary of my problem again; </div>
<div> </div>
<div>Our work place has <a href="http://192.168.1.0/24"></b></font><font color="red"><b>MailScanner has detected a possible fraud attempt from "192.168.1.0" claiming to be</b></font> <font color="red"><b>MailScanner warning: numerical links are often malicious: 192.168.1.0/24</a> subnet for office use and I have another<br>LAN for test purposes within this office network. My test LAN has<br><a href="http://10.10.10.0/24"></b></font><font color="red"><b>MailScanner has detected a possible fraud attempt from "10.10.10.0" claiming to be</b></font> <font color="red"><b>MailScanner warning: numerical links are often malicious: 10.10.10.0/24
</a> subnet and has a connection to the <a href="http://192.168.1.0/24"></b></font><font color="red"><b>MailScanner has detected a possible fraud attempt from "192.168.1.0" claiming to be</b></font> <font color="red"><b>MailScanner warning: numerical links are often malicious: 192.168.1.0/24</a> office<br>network through a router gateway. In my test LAN, I have a Linux machine<br>(Suse 10.0) kernel 2.6.13. This linux machine is also a DHCP server for the
<br>test LAN. I want remote windows and linux clients to get IP addresses from this DHCP server.<br><br>I installed CertificateAuthority (CA) in the Linux Machine in my test LAN and created x509 certificates for the<br>Linux machine and Windows client, transffered the certificates to
<br>appropriate places and to the Windows XP client. And then I installed<br>Openswan 2.4.0 into the Linux machine, opened UDP 500 and UDP 4500 ports in it's firewall.<br>I also opened UDP 500 and UDP 4500 ports on my router gateway machine as well.
<br><br>-- By using<br><br>#ipsec verify</div>
<div> </div>
<div>command I get this from Linux Machine<br><br>Checking your system to see if IPsec got installed and started correctly:<br>Version check and ipsec on-path<br> [OK]<br>Linux Openswan U2.4.0rc5/K2.6.13-15-smp (netkey)
<br>Checking for IPsec support in kernel<br>[OK]<br>Checking for RSA private key (/etc/ipsec.secrets) [OK]<br><br>Checking that pluto is running<br>[OK]<br>Two or more interfaces found, checking IP forwarding [OK]
<br>Checking NAT and MASQUERADEing [OK]<br>Checking for 'ip' command<br>[OK]<br>Checking for 'iptables' command<br>[OK]<br>Checking for 'curl' command for CRL fetching [OK]
<br>Checking for 'setkey' command for NETKEY IPsec stack support [OK]<br>Opportunistic Encryption Support<br>[Disabled]<br><br>so everything seems OK here.<br><br>-- IPSec service is running well at the Windows Machine.
<br><br>-- I am using lsipsectool.exe at the Windows Machine. When I try to<br>establish a VPN connection between the Windows client and LInux Machine, the<br>connection has not been able to established. But if you look at the log files, especially the log file from the linux machine and the windows event viewer, it seems that Main mode and Quick mode associations are established. Until I stop it, the
lsipsectool.exe keep pinging without a success. </div>
<div> </div>
<div>I went through all the log files, line by line, to see what problem is. As far as linux box concerned, everything seems alright. </div>
<div> </div>
<div>I couldn't interpret the oakley.log file completely. </div>
<div> </div>
<div>Can anyone help me on this issue to solve my connection problem? </div>
<div>I would also appreciate if anyone send me a link or documentation to read to interpret oakley.log file properly/</div>
<div> </div>
<div> </div>
<div>Thank very much for your time.</div>
<div> </div>
<div>Can Akalin</div>
<div> </div>
<div><br><br>>>>>>>>>>>>>>>>>>>>>>>> HERE IS THE LOG FILE FROM lsipsectool<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<
<br><br> </div>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt; mso-layout-grid-align: none"><span style="FONT-SIZE: 8.5pt; FONT-FAMILY: 'MS Shell Dlg'"> </span></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt; mso-layout-grid-align: none"><span style="FONT-SIZE: 8.5pt; FONT-FAMILY: 'MS Shell Dlg'">10:08:24: Starting Tunnel</span></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt; mso-layout-grid-align: none"><span style="FONT-SIZE: 8.5pt; FONT-FAMILY: 'MS Shell Dlg'"> </span></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt; mso-layout-grid-align: none"><span style="FONT-SIZE: 8.5pt; FONT-FAMILY: 'MS Shell Dlg'">10:08:25: IKE Encryption: 3des</span></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt; mso-layout-grid-align: none"><span style="FONT-SIZE: 8.5pt; FONT-FAMILY: 'MS Shell Dlg'">IKE Integrity: md5</span></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt; mso-layout-grid-align: none"><span style="FONT-SIZE: 8.5pt; FONT-FAMILY: 'MS Shell Dlg'">Remote Gateway Address: <a href="http://192.168.1.55"></b></font><font color="red"><b>MailScanner has detected a possible fraud attempt from "192.168.1.55" claiming to be</b></font> <font color="red"><b>MailScanner warning: numerical links are often malicious: 192.168.1.55</a></span></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt; mso-layout-grid-align: none"><span style="FONT-SIZE: 8.5pt; FONT-FAMILY: 'MS Shell Dlg'">Remote Monitor Address: <a href="http://10.10.10.10"></b></font><font color="red"><b>MailScanner has detected a possible fraud attempt from "10.10.10.10" claiming to be</b></font> <font color="red"><b>MailScanner warning: numerical links are often malicious: 10.10.10.10</a></span></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt; mso-layout-grid-align: none"><span style="FONT-SIZE: 8.5pt; FONT-FAMILY: 'MS Shell Dlg'">Remote Network: <a href="http://10.10.10.0/255.255.255.0"></b></font><font color="red"><b>MailScanner has detected a possible fraud attempt from "10.10.10.0" claiming to be</b></font> <font color="red"><b>MailScanner warning: numerical links are often malicious: 10.10.10.0/255.255.255.0
</a></span></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt; mso-layout-grid-align: none"><span style="FONT-SIZE: 8.5pt; FONT-FAMILY: 'MS Shell Dlg'">Local Address: <a href="http://192.168.1.72"></b></font><font color="red"><b>MailScanner has detected a possible fraud attempt from "192.168.1.72" claiming to be</b></font> <font color="red"><b>MailScanner warning: numerical links are often malicious: 192.168.1.72</a></span></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt; mso-layout-grid-align: none"><span style="FONT-SIZE: 8.5pt; FONT-FAMILY: 'MS Shell Dlg'">Local Network: <a href="http://192.168.1.72/255.255.255.255"></b></font><font color="red"><b>MailScanner has detected a possible fraud attempt from "192.168.1.72" claiming to be</b></font> <font color="red"><b>MailScanner warning: numerical links are often malicious: 192.168.1.72/255.255.255.255
</a></span></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt; mso-layout-grid-align: none"><span style="FONT-SIZE: 8.5pt; FONT-FAMILY: 'MS Shell Dlg'"> </span></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt; mso-layout-grid-align: none"><span style="FONT-SIZE: 8.5pt; FONT-FAMILY: 'MS Shell Dlg'">10:08:28: 15 Consecutive Unsuccessfull ECHO REQUEST [ Waiting 5 Secs ]...</span></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt; mso-layout-grid-align: none"><span style="FONT-SIZE: 8.5pt; FONT-FAMILY: 'MS Shell Dlg'"> </span></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt; mso-layout-grid-align: none"><span style="FONT-SIZE: 8.5pt; FONT-FAMILY: 'MS Shell Dlg'">10:09:12: 30 Consecutive Unsuccessfull ECHO REQUEST [ Waiting 5 Secs ]...</span></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt; mso-layout-grid-align: none"><span style="FONT-SIZE: 8.5pt; FONT-FAMILY: 'MS Shell Dlg'"> </span></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt; mso-layout-grid-align: none"><span style="FONT-SIZE: 8.5pt; FONT-FAMILY: 'MS Shell Dlg'">10:09:54: 45 Consecutive Unsuccessfull ECHO REQUEST [ Waiting 5 Secs ]...</span></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt; mso-layout-grid-align: none"><span style="FONT-SIZE: 8.5pt; FONT-FAMILY: 'MS Shell Dlg'"> </span></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt; mso-layout-grid-align: none"><span style="FONT-SIZE: 8.5pt; FONT-FAMILY: 'MS Shell Dlg'">10:10:37: 60 Consecutive Unsuccessfull ECHO REQUEST [ Waiting 5 Secs ]...</span></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt; mso-layout-grid-align: none"><span style="FONT-SIZE: 8.5pt; FONT-FAMILY: 'MS Shell Dlg'"> </span></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt; mso-layout-grid-align: none"><span style="FONT-SIZE: 8.5pt; FONT-FAMILY: 'MS Shell Dlg'">10:10:41: Stoping Tunnel</span></p>
<p> </p>
<div> </div>
<div> </div>
<div> </div>
<div> </div>
<div>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>HERE IS THE LOG FILE FROM WINDOWS EVENT VIEWER<<<<<<<<<<<<<<<<<<<<<<<<<<<
<br><span style="FONT-SIZE: 8.5pt; FONT-FAMILY: 'MS Shell Dlg'"> </span></div>
<div>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt; mso-layout-grid-align: none"><span style="FONT-SIZE: 8.5pt; FONT-FAMILY: 'MS Shell Dlg'"> </span></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt; mso-layout-grid-align: none"><span style="FONT-SIZE: 8.5pt; FONT-FAMILY: 'MS Shell Dlg'">IKE security association established.</span></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt; mso-layout-grid-align: none"><span style="FONT-SIZE: 8.5pt; FONT-FAMILY: 'MS Shell Dlg'"><span style="mso-spacerun: yes"> </span>Mode: </span></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt; mso-layout-grid-align: none"><span style="FONT-SIZE: 8.5pt; FONT-FAMILY: 'MS Shell Dlg'">Key Exchange Mode (Main Mode)</span></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt; mso-layout-grid-align: none"><span style="FONT-SIZE: 8.5pt; FONT-FAMILY: 'MS Shell Dlg'"> </span></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt; mso-layout-grid-align: none"><span style="FONT-SIZE: 8.5pt; FONT-FAMILY: 'MS Shell Dlg'"><span style="mso-spacerun: yes"> </span>Peer Identity: </span></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt; mso-layout-grid-align: none"><span style="FONT-SIZE: 8.5pt; FONT-FAMILY: 'MS Shell Dlg'">Certificate based Identity.<span style="mso-spacerun: yes"> </span></span></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt; mso-layout-grid-align: none"><span style="FONT-SIZE: 8.5pt; FONT-FAMILY: 'MS Shell Dlg'">Peer Subject C=CA, S=Ontario, L=Toronto, O=Internet Widgits Pty Ltd, OU=SRN, CN=deneme1, E=
<a href="mailto:deneme1@springboardnetworks.com">deneme1@springboardnetworks.com</a></span></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt; mso-layout-grid-align: none"><span style="FONT-SIZE: 8.5pt; FONT-FAMILY: 'MS Shell Dlg'">Peer SHA Thumbprint 173111919eb4dc726dc3cf2f1d6e1d9489f9e522</span></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt; mso-layout-grid-align: none"><span style="FONT-SIZE: 8.5pt; FONT-FAMILY: 'MS Shell Dlg'">Peer Issuing Certificate Authority C=CA, S=Ontario, L=Toronto, O=Springboard Retail Networks Inc., CN=OzgUN, E=
<a href="mailto:ozgun@springboardnetworks.com">ozgun@springboardnetworks.com</a></span></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt; mso-layout-grid-align: none"><span style="FONT-SIZE: 8.5pt; FONT-FAMILY: 'MS Shell Dlg'">Root Certificate Authority C=CA, S=Ontario, L=Toronto, O=Springboard Retail Networks Inc., CN=OzgUN, E=
<a href="mailto:ozgun@springboardnetworks.com">ozgun@springboardnetworks.com</a></span></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt; mso-layout-grid-align: none"><span style="FONT-SIZE: 8.5pt; FONT-FAMILY: 'MS Shell Dlg'">My Subject C=CA, S=Ontario, O=Springboard Retail Networks Inc., CN=laptop, E=<a href="mailto:laptop@springboardnetworks.com">
laptop@springboardnetworks.com</a></span></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt; mso-layout-grid-align: none"><span style="FONT-SIZE: 8.5pt; FONT-FAMILY: 'MS Shell Dlg'">My SHA Thumbprint 9f120fd256be49e28c1df547aef9a1256ebef09e</span></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt; mso-layout-grid-align: none"><span style="FONT-SIZE: 8.5pt; FONT-FAMILY: 'MS Shell Dlg'">Peer IP Address: <a href="http://192.168.1.55"></b></font><font color="red"><b>MailScanner has detected a possible fraud attempt from "192.168.1.55" claiming to be</b></font> <font color="red"><b>MailScanner warning: numerical links are often malicious: 192.168.1.55</a></span></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt; mso-layout-grid-align: none"><span style="FONT-SIZE: 8.5pt; FONT-FAMILY: 'MS Shell Dlg'"> </span></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt; mso-layout-grid-align: none"><span style="FONT-SIZE: 8.5pt; FONT-FAMILY: 'MS Shell Dlg'"><span style="mso-spacerun: yes"> </span>Filter: </span></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt; mso-layout-grid-align: none"><span style="FONT-SIZE: 8.5pt; FONT-FAMILY: 'MS Shell Dlg'">Source IP Address <a href="http://192.168.1.72"></b></font><font color="red"><b>MailScanner has detected a possible fraud attempt from "192.168.1.72" claiming to be</b></font> <font color="red"><b>MailScanner warning: numerical links are often malicious: 192.168.1.72</a></span></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt; mso-layout-grid-align: none"><span style="FONT-SIZE: 8.5pt; FONT-FAMILY: 'MS Shell Dlg'">Source IP Address Mask <a href="http://255.255.255.255"></b></font><font color="red"><b>MailScanner has detected a possible fraud attempt from "255.255.255.255" claiming to be</b></font> <font color="red"><b>MailScanner warning: numerical links are often malicious: 255.255.255.255</a></span>
</p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt; mso-layout-grid-align: none"><span style="FONT-SIZE: 8.5pt; FONT-FAMILY: 'MS Shell Dlg'">Destination IP Address <a href="http://192.168.1.55"></b></font><font color="red"><b>MailScanner has detected a possible fraud attempt from "192.168.1.55" claiming to be</b></font> <font color="red"><b>MailScanner warning: numerical links are often malicious: 192.168.1.55</a></span></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt; mso-layout-grid-align: none"><span style="FONT-SIZE: 8.5pt; FONT-FAMILY: 'MS Shell Dlg'">Destination IP Address Mask <a href="http://255.255.255.255"></b></font><font color="red"><b>MailScanner has detected a possible fraud attempt from "255.255.255.255" claiming to be</b></font> <font color="red"><b>MailScanner warning: numerical links are often malicious: 255.255.255.255</a></span>
</p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt; mso-layout-grid-align: none"><span style="FONT-SIZE: 8.5pt; FONT-FAMILY: 'MS Shell Dlg'">Protocol 0</span></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt; mso-layout-grid-align: none"><span style="FONT-SIZE: 8.5pt; FONT-FAMILY: 'MS Shell Dlg'">Source</span><span style="FONT-SIZE: 8.5pt; FONT-FAMILY: 'MS Shell Dlg'"> Port</span>
<span style="FONT-SIZE: 8.5pt; FONT-FAMILY: 'MS Shell Dlg'"> 0</span></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt; mso-layout-grid-align: none"><span style="FONT-SIZE: 8.5pt; FONT-FAMILY: 'MS Shell Dlg'">Destination</span><span style="FONT-SIZE: 8.5pt; FONT-FAMILY: 'MS Shell Dlg'"> Port
</span><span style="FONT-SIZE: 8.5pt; FONT-FAMILY: 'MS Shell Dlg'"> 0</span></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt; mso-layout-grid-align: none"><span style="FONT-SIZE: 8.5pt; FONT-FAMILY: 'MS Shell Dlg'">IKE Local Addr <a href="http://192.168.1.72"></b></font><font color="red"><b>MailScanner has detected a possible fraud attempt from "192.168.1.72" claiming to be</b></font> <font color="red"><b>MailScanner warning: numerical links are often malicious: 192.168.1.72</a></span></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt; mso-layout-grid-align: none"><span style="FONT-SIZE: 8.5pt; FONT-FAMILY: 'MS Shell Dlg'">IKE Peer Addr <a href="http://192.168.1.55"></b></font><font color="red"><b>MailScanner has detected a possible fraud attempt from "192.168.1.55" claiming to be</b></font> <font color="red"><b>MailScanner warning: numerical links are often malicious: 192.168.1.55</a></span></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt; mso-layout-grid-align: none"><span style="FONT-SIZE: 8.5pt; FONT-FAMILY: 'MS Shell Dlg'"> </span></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt; mso-layout-grid-align: none"><span style="FONT-SIZE: 8.5pt; FONT-FAMILY: 'MS Shell Dlg'"><span style="mso-spacerun: yes"> </span>Parameters: </span></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt; mso-layout-grid-align: none"><span style="FONT-SIZE: 8.5pt; FONT-FAMILY: 'MS Shell Dlg'">ESP Algorithm Triple DES CBC</span></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt; mso-layout-grid-align: none"><span style="FONT-SIZE: 8.5pt; FONT-FAMILY: 'MS Shell Dlg'">HMAC Algorithm SHA</span></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt; mso-layout-grid-align: none"><span style="FONT-SIZE: 8.5pt; FONT-FAMILY: 'MS Shell Dlg'">Lifetime (sec) 350</span></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt; mso-layout-grid-align: none"><span style="FONT-SIZE: 8.5pt; FONT-FAMILY: 'MS Shell Dlg'"></span> </p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt; mso-layout-grid-align: none"><span style="FONT-SIZE: 8.5pt; FONT-FAMILY: 'MS Shell Dlg'">++++++++++++++++++++++++++++++++++++++++++++++++++++++++++</span></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt; mso-layout-grid-align: none"><span style="FONT-SIZE: 8.5pt; FONT-FAMILY: 'MS Shell Dlg'"> </span></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt; mso-layout-grid-align: none"><span style="FONT-SIZE: 8.5pt; FONT-FAMILY: 'MS Shell Dlg'">IKE security association established.</span></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt; mso-layout-grid-align: none"><span style="FONT-SIZE: 8.5pt; FONT-FAMILY: 'MS Shell Dlg'"><span style="mso-spacerun: yes"> </span>Mode: </span></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt; mso-layout-grid-align: none"><span style="FONT-SIZE: 8.5pt; FONT-FAMILY: 'MS Shell Dlg'">Data Protection Mode (Quick Mode)</span></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt; mso-layout-grid-align: none"><span style="FONT-SIZE: 8.5pt; FONT-FAMILY: 'MS Shell Dlg'"> </span></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt; mso-layout-grid-align: none"><span style="FONT-SIZE: 8.5pt; FONT-FAMILY: 'MS Shell Dlg'"><span style="mso-spacerun: yes"> </span>Peer Identity: </span></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt; mso-layout-grid-align: none"><span style="FONT-SIZE: 8.5pt; FONT-FAMILY: 'MS Shell Dlg'">Certificate based Identity.<span style="mso-spacerun: yes"> </span></span></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt; mso-layout-grid-align: none"><span style="FONT-SIZE: 8.5pt; FONT-FAMILY: 'MS Shell Dlg'">Peer Subject C=CA, S=Ontario, L=Toronto, O=Internet Widgits Pty Ltd, OU=SRN, CN=deneme1, E=
<a href="mailto:deneme1@springboardnetworks.com">deneme1@springboardnetworks.com</a></span></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt; mso-layout-grid-align: none"><span style="FONT-SIZE: 8.5pt; FONT-FAMILY: 'MS Shell Dlg'">Peer SHA Thumbprint 173111919eb4dc726dc3cf2f1d6e1d9489f9e522</span></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt; mso-layout-grid-align: none"><span style="FONT-SIZE: 8.5pt; FONT-FAMILY: 'MS Shell Dlg'">Peer Issuing Certificate Authority C=CA, S=Ontario, L=Toronto, O=Springboard Retail Networks Inc., CN=OzgUN, E=
<a href="mailto:ozgun@springboardnetworks.com">ozgun@springboardnetworks.com</a></span></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt; mso-layout-grid-align: none"><span style="FONT-SIZE: 8.5pt; FONT-FAMILY: 'MS Shell Dlg'">Root Certificate Authority C=CA, S=Ontario, L=Toronto, O=Springboard Retail Networks Inc., CN=OzgUN, E=
<a href="mailto:ozgun@springboardnetworks.com">ozgun@springboardnetworks.com</a></span></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt; mso-layout-grid-align: none"><span style="FONT-SIZE: 8.5pt; FONT-FAMILY: 'MS Shell Dlg'">My Subject C=CA, S=Ontario, O=Springboard Retail Networks Inc., CN=laptop, E=<a href="mailto:laptop@springboardnetworks.com">
laptop@springboardnetworks.com</a></span></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt; mso-layout-grid-align: none"><span style="FONT-SIZE: 8.5pt; FONT-FAMILY: 'MS Shell Dlg'">My SHA Thumbprint 9f120fd256be49e28c1df547aef9a1256ebef09e</span></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt; mso-layout-grid-align: none"><span style="FONT-SIZE: 8.5pt; FONT-FAMILY: 'MS Shell Dlg'">Peer IP Address: <a href="http://192.168.1.55"></b></font><font color="red"><b>MailScanner has detected a possible fraud attempt from "192.168.1.55" claiming to be</b></font> <font color="red"><b>MailScanner warning: numerical links are often malicious: 192.168.1.55</a></span></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt; mso-layout-grid-align: none"><span style="FONT-SIZE: 8.5pt; FONT-FAMILY: 'MS Shell Dlg'"> </span></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt; mso-layout-grid-align: none"><span style="FONT-SIZE: 8.5pt; FONT-FAMILY: 'MS Shell Dlg'"><span style="mso-spacerun: yes"> </span>Filter: </span></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt; mso-layout-grid-align: none"><span style="FONT-SIZE: 8.5pt; FONT-FAMILY: 'MS Shell Dlg'">Source IP Address <a href="http://192.168.1.72"></b></font><font color="red"><b>MailScanner has detected a possible fraud attempt from "192.168.1.72" claiming to be</b></font> <font color="red"><b>MailScanner warning: numerical links are often malicious: 192.168.1.72</a></span></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt; mso-layout-grid-align: none"><span style="FONT-SIZE: 8.5pt; FONT-FAMILY: 'MS Shell Dlg'">Source IP Address Mask <a href="http://255.255.255.255"></b></font><font color="red"><b>MailScanner has detected a possible fraud attempt from "255.255.255.255" claiming to be</b></font> <font color="red"><b>MailScanner warning: numerical links are often malicious: 255.255.255.255</a></span>
</p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt; mso-layout-grid-align: none"><span style="FONT-SIZE: 8.5pt; FONT-FAMILY: 'MS Shell Dlg'">Destination IP Address <a href="http://10.10.10.0"></b></font><font color="red"><b>MailScanner has detected a possible fraud attempt from "10.10.10.0" claiming to be</b></font> <font color="red"><b>MailScanner warning: numerical links are often malicious: 10.10.10.0</a></span></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt; mso-layout-grid-align: none"><span style="FONT-SIZE: 8.5pt; FONT-FAMILY: 'MS Shell Dlg'">Destination IP Address Mask <a href="http://255.255.255.0"></b></font><font color="red"><b>MailScanner has detected a possible fraud attempt from "255.255.255.0" claiming to be</b></font> <font color="red"><b>MailScanner warning: numerical links are often malicious: 255.255.255.0</a></span>
</p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt; mso-layout-grid-align: none"><span style="FONT-SIZE: 8.5pt; FONT-FAMILY: 'MS Shell Dlg'">Protocol 0</span></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt; mso-layout-grid-align: none"><span style="FONT-SIZE: 8.5pt; FONT-FAMILY: 'MS Shell Dlg'">Source</span><span style="FONT-SIZE: 8.5pt; FONT-FAMILY: 'MS Shell Dlg'"> Port</span>
<span style="FONT-SIZE: 8.5pt; FONT-FAMILY: 'MS Shell Dlg'"> 0</span></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt; mso-layout-grid-align: none"><span style="FONT-SIZE: 8.5pt; FONT-FAMILY: 'MS Shell Dlg'">Destination</span><span style="FONT-SIZE: 8.5pt; FONT-FAMILY: 'MS Shell Dlg'"> Port
</span><span style="FONT-SIZE: 8.5pt; FONT-FAMILY: 'MS Shell Dlg'"> 0</span></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt; mso-layout-grid-align: none"><span style="FONT-SIZE: 8.5pt; FONT-FAMILY: 'MS Shell Dlg'">IKE Local Addr <a href="http://192.168.1.72"></b></font><font color="red"><b>MailScanner has detected a possible fraud attempt from "192.168.1.72" claiming to be</b></font> <font color="red"><b>MailScanner warning: numerical links are often malicious: 192.168.1.72</a></span></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt; mso-layout-grid-align: none"><span style="FONT-SIZE: 8.5pt; FONT-FAMILY: 'MS Shell Dlg'">IKE Peer Addr <a href="http://192.168.1.55"></b></font><font color="red"><b>MailScanner has detected a possible fraud attempt from "192.168.1.55" claiming to be</b></font> <font color="red"><b>MailScanner warning: numerical links are often malicious: 192.168.1.55</a></span></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt; mso-layout-grid-align: none"><span style="FONT-SIZE: 8.5pt; FONT-FAMILY: 'MS Shell Dlg'"> </span></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt; mso-layout-grid-align: none"><span style="FONT-SIZE: 8.5pt; FONT-FAMILY: 'MS Shell Dlg'"><span style="mso-spacerun: yes"> </span>Parameters: </span></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt; mso-layout-grid-align: none"><span style="FONT-SIZE: 8.5pt; FONT-FAMILY: 'MS Shell Dlg'">ESP Algorithm Triple DES CBC</span></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt; mso-layout-grid-align: none"><span style="FONT-SIZE: 8.5pt; FONT-FAMILY: 'MS Shell Dlg'">HMAC Algorithm MD5</span></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt; mso-layout-grid-align: none"><span style="FONT-SIZE: 8.5pt; FONT-FAMILY: 'MS Shell Dlg'">AH Algorithm None</span></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt; mso-layout-grid-align: none"><span style="FONT-SIZE: 8.5pt; FONT-FAMILY: 'MS Shell Dlg'">Encapsulation 61443</span></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt; mso-layout-grid-align: none"><span style="FONT-SIZE: 8.5pt; FONT-FAMILY: 'MS Shell Dlg'">InboundSpi 1867691868 (0x6f52b75c)</span></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt; mso-layout-grid-align: none"><span style="FONT-SIZE: 8.5pt; FONT-FAMILY: 'MS Shell Dlg'">OutBoundSpi 1473643236 (0x57d602e4)</span></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt; mso-layout-grid-align: none"><span style="FONT-SIZE: 8.5pt; FONT-FAMILY: 'MS Shell Dlg'">Lifetime (sec) 3600</span></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt; mso-layout-grid-align: none"><span style="FONT-SIZE: 8.5pt; FONT-FAMILY: 'MS Shell Dlg'">Lifetime (kb) 100000</span></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt; mso-layout-grid-align: none"><span style="FONT-SIZE: 8.5pt; FONT-FAMILY: 'MS Shell Dlg'"> </span></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt; mso-layout-grid-align: none"><span style="FONT-SIZE: 8.5pt; FONT-FAMILY: 'MS Shell Dlg'"> </span></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt; mso-layout-grid-align: none"><span style="FONT-SIZE: 8.5pt; FONT-FAMILY: 'MS Shell Dlg'">+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++</span></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt; mso-layout-grid-align: none"><span style="FONT-SIZE: 8.5pt; FONT-FAMILY: 'MS Shell Dlg'"></span> </p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt; mso-layout-grid-align: none"><span style="FONT-SIZE: 8.5pt; FONT-FAMILY: 'MS Shell Dlg'">IKE security association ended.</span></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt; mso-layout-grid-align: none"><span style="FONT-SIZE: 8.5pt; FONT-FAMILY: 'MS Shell Dlg'"><span style="mso-spacerun: yes"> </span>Mode: Data Protection (Quick mode) Filter:
</span></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt; mso-layout-grid-align: none"><span style="FONT-SIZE: 8.5pt; FONT-FAMILY: 'MS Shell Dlg'">Source IP Address <a href="http://192.168.1.72"></b></font><font color="red"><b>MailScanner has detected a possible fraud attempt from "192.168.1.72" claiming to be</b></font> <font color="red"><b>MailScanner warning: numerical links are often malicious: 192.168.1.72</a></span></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt; mso-layout-grid-align: none"><span style="FONT-SIZE: 8.5pt; FONT-FAMILY: 'MS Shell Dlg'">Source IP Address Mask <a href="http://255.255.255.255"></b></font><font color="red"><b>MailScanner has detected a possible fraud attempt from "255.255.255.255" claiming to be</b></font> <font color="red"><b>MailScanner warning: numerical links are often malicious: 255.255.255.255</a></span>
</p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt; mso-layout-grid-align: none"><span style="FONT-SIZE: 8.5pt; FONT-FAMILY: 'MS Shell Dlg'">Destination IP Address <a href="http://10.10.10.0"></b></font><font color="red"><b>MailScanner has detected a possible fraud attempt from "10.10.10.0" claiming to be</b></font> <font color="red"><b>MailScanner warning: numerical links are often malicious: 10.10.10.0</a></span></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt; mso-layout-grid-align: none"><span style="FONT-SIZE: 8.5pt; FONT-FAMILY: 'MS Shell Dlg'">Destination IP Address Mask <a href="http://255.255.255.0"></b></font><font color="red"><b>MailScanner has detected a possible fraud attempt from "255.255.255.0" claiming to be</b></font> <font color="red"><b>MailScanner warning: numerical links are often malicious: 255.255.255.0</a></span>
</p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt; mso-layout-grid-align: none"><span style="FONT-SIZE: 8.5pt; FONT-FAMILY: 'MS Shell Dlg'">Protocol 0</span></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt; mso-layout-grid-align: none"><span style="FONT-SIZE: 8.5pt; FONT-FAMILY: 'MS Shell Dlg'">Source</span><span style="FONT-SIZE: 8.5pt; FONT-FAMILY: 'MS Shell Dlg'"> Port</span>
<span style="FONT-SIZE: 8.5pt; FONT-FAMILY: 'MS Shell Dlg'"> 0</span></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt; mso-layout-grid-align: none"><span style="FONT-SIZE: 8.5pt; FONT-FAMILY: 'MS Shell Dlg'">Destination</span><span style="FONT-SIZE: 8.5pt; FONT-FAMILY: 'MS Shell Dlg'"> Port
</span><span style="FONT-SIZE: 8.5pt; FONT-FAMILY: 'MS Shell Dlg'"> 0</span></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt; mso-layout-grid-align: none"><span style="FONT-SIZE: 8.5pt; FONT-FAMILY: 'MS Shell Dlg'">IKE Local Addr <a href="http://192.168.1.72"></b></font><font color="red"><b>MailScanner has detected a possible fraud attempt from "192.168.1.72" claiming to be</b></font> <font color="red"><b>MailScanner warning: numerical links are often malicious: 192.168.1.72</a></span></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt; mso-layout-grid-align: none"><span style="FONT-SIZE: 8.5pt; FONT-FAMILY: 'MS Shell Dlg'">IKE Peer Addr <a href="http://192.168.1.55"></b></font><font color="red"><b>MailScanner has detected a possible fraud attempt from "192.168.1.55" claiming to be</b></font> <font color="red"><b>MailScanner warning: numerical links are often malicious: 192.168.1.55</a></span></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt; mso-layout-grid-align: none"><span style="FONT-SIZE: 8.5pt; FONT-FAMILY: 'MS Shell Dlg'"> </span></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt; mso-layout-grid-align: none"><span style="FONT-SIZE: 8.5pt; FONT-FAMILY: 'MS Shell Dlg'"><span style="mso-spacerun: yes"> </span>Inbound SPI: </span></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt; mso-layout-grid-align: none"><span style="FONT-SIZE: 8.5pt; FONT-FAMILY: 'MS Shell Dlg'">1867691868 (0x6f52b75c)</span></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt; mso-layout-grid-align: none"><span style="FONT-SIZE: 8.5pt; FONT-FAMILY: 'MS Shell Dlg'"><span style="mso-spacerun: yes"> </span>Outbound SPI: </span></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt; mso-layout-grid-align: none"><span style="FONT-SIZE: 8.5pt; FONT-FAMILY: 'MS Shell Dlg'">1473643236 (0x57d602e4)</span></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt; mso-layout-grid-align: none"><span style="FONT-SIZE: 8.5pt; FONT-FAMILY: 'MS Shell Dlg'"></span> </p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt; mso-layout-grid-align: none"><span style="FONT-SIZE: 8.5pt; FONT-FAMILY: 'MS Shell Dlg'">+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++</span></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt"><font face="Times New Roman"> </font></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt; mso-layout-grid-align: none"><span style="FONT-SIZE: 8.5pt; FONT-FAMILY: 'MS Shell Dlg'">IKE security association ended.</span></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt; mso-layout-grid-align: none"><span style="FONT-SIZE: 8.5pt; FONT-FAMILY: 'MS Shell Dlg'"><span style="mso-spacerun: yes"> </span>Mode: Key Exchange (Main mode)</span></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt; mso-layout-grid-align: none"><span style="FONT-SIZE: 8.5pt; FONT-FAMILY: 'MS Shell Dlg'"><span style="mso-spacerun: yes"> </span>Filter: </span></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt; mso-layout-grid-align: none"><span style="FONT-SIZE: 8.5pt; FONT-FAMILY: 'MS Shell Dlg'">Source IP Address <a href="http://192.168.1.72"></b></font><font color="red"><b>MailScanner has detected a possible fraud attempt from "192.168.1.72" claiming to be</b></font> <font color="red"><b>MailScanner warning: numerical links are often malicious: 192.168.1.72</a></span></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt; mso-layout-grid-align: none"><span style="FONT-SIZE: 8.5pt; FONT-FAMILY: 'MS Shell Dlg'">Source IP Address Mask <a href="http://255.255.255.255"></b></font><font color="red"><b>MailScanner has detected a possible fraud attempt from "255.255.255.255" claiming to be</b></font> <font color="red"><b>MailScanner warning: numerical links are often malicious: 255.255.255.255</a></span>
</p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt; mso-layout-grid-align: none"><span style="FONT-SIZE: 8.5pt; FONT-FAMILY: 'MS Shell Dlg'">Destination IP Address <a href="http://192.168.1.55"></b></font><font color="red"><b>MailScanner has detected a possible fraud attempt from "192.168.1.55" claiming to be</b></font> <font color="red"><b>MailScanner warning: numerical links are often malicious: 192.168.1.55</a></span></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt; mso-layout-grid-align: none"><span style="FONT-SIZE: 8.5pt; FONT-FAMILY: 'MS Shell Dlg'">Destination IP Address Mask <a href="http://255.255.255.255"></b></font><font color="red"><b>MailScanner has detected a possible fraud attempt from "255.255.255.255" claiming to be</b></font> <font color="red"><b>MailScanner warning: numerical links are often malicious: 255.255.255.255</a></span>
</p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt; mso-layout-grid-align: none"><span style="FONT-SIZE: 8.5pt; FONT-FAMILY: 'MS Shell Dlg'">Protocol 0</span></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt; mso-layout-grid-align: none"><span style="FONT-SIZE: 8.5pt; FONT-FAMILY: 'MS Shell Dlg'">Source</span><span style="FONT-SIZE: 8.5pt; FONT-FAMILY: 'MS Shell Dlg'"> Port</span>
<span style="FONT-SIZE: 8.5pt; FONT-FAMILY: 'MS Shell Dlg'"> 0</span></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt; mso-layout-grid-align: none"><span style="FONT-SIZE: 8.5pt; FONT-FAMILY: 'MS Shell Dlg'">Destination</span><span style="FONT-SIZE: 8.5pt; FONT-FAMILY: 'MS Shell Dlg'"> Port
</span><span style="FONT-SIZE: 8.5pt; FONT-FAMILY: 'MS Shell Dlg'"> 0</span></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt; mso-layout-grid-align: none"><span style="FONT-SIZE: 8.5pt; FONT-FAMILY: 'MS Shell Dlg'">IKE Local Addr <a href="http://192.168.1.72"></b></font><font color="red"><b>MailScanner has detected a possible fraud attempt from "192.168.1.72" claiming to be</b></font> <font color="red"><b>MailScanner warning: numerical links are often malicious: 192.168.1.72</a></span></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt; mso-layout-grid-align: none"><span style="FONT-SIZE: 8.5pt; FONT-FAMILY: 'MS Shell Dlg'">IKE Peer Addr <a href="http://192.168.1.55"></b></font><font color="red"><b>MailScanner has detected a possible fraud attempt from "192.168.1.55" claiming to be</b></font> <font color="red"><b>MailScanner warning: numerical links are often malicious: 192.168.1.55</a></span></p></div>
<div> </div>
<div> </div>
<div> </div>
<div> </div>
<div> </div>
<div>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt"><font face="Times New Roman">>>>>>>>>>>>>>>>>>>>>>>>>>>>>LOG FILE FROM LINUX BOX /var/log/messages<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<
</font></p></div>
<div> </div>
<div> </div>
<div> </div>
<div>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt"><font face="Times New Roman"><b style="mso-bidi-font-weight: normal">Mar 17 10:08:47 linuxserver pluto[5747]</b>: packet from <a href="http://192.168.1.72:500"></b></font><font color="red"><b>MailScanner has detected a possible fraud attempt from "192.168.1.72:500" claiming to be</b></font> <font color="red"><b>MailScanner warning: numerical links are often malicious: 192.168.1.72:500
</a>: ignoring Vendor ID payload [MS NT5 ISAKMPOAKLEY 00000004]</font></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt"><font face="Times New Roman"><b style="mso-bidi-font-weight: normal">Mar 17 10:08:47 linuxserver pluto[5747]:</b> packet from <a href="http://192.168.1.72:500"></b></font><font color="red"><b>MailScanner has detected a possible fraud attempt from "192.168.1.72:500" claiming to be</b></font> <font color="red"><b>MailScanner warning: numerical links are often malicious: 192.168.1.72:500
</a>: ignoring Vendor ID payload [FRAGMENTATION]</font></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt"><font face="Times New Roman"><b style="mso-bidi-font-weight: normal">Mar 17 10:08:47 linuxserver pluto[5747]</b>: packet from <a href="http://192.168.1.72:500"></b></font><font color="red"><b>MailScanner has detected a possible fraud attempt from "192.168.1.72:500" claiming to be</b></font> <font color="red"><b>MailScanner warning: numerical links are often malicious: 192.168.1.72:500
</a>: received Vendor ID payload [draft-ietf-ipsec-nat-t-ike-02_n] method set to=106 </font></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt"><font face="Times New Roman"><b style="mso-bidi-font-weight: normal">Mar 17 10:08:47 linuxserver pluto[5747]</b>: packet from <a href="http://192.168.1.72:500"></b></font><font color="red"><b>MailScanner has detected a possible fraud attempt from "192.168.1.72:500" claiming to be</b></font> <font color="red"><b>MailScanner warning: numerical links are often malicious: 192.168.1.72:500
</a>: ignoring Vendor ID payload [Vid-Initial-Contact]</font></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt"><font face="Times New Roman"><b style="mso-bidi-font-weight: normal">Mar 17 10:08:47 linuxserver pluto[5747]:</b> "roadwarrior"[1] <a href="http://192.168.1.72"></b></font><font color="red"><b>MailScanner has detected a possible fraud attempt from "192.168.1.72" claiming to be</b></font> <font color="red"><b>MailScanner warning: numerical links are often malicious:
192.168.1.72</a> #1: responding to Main Mode from unknown peer <a href="http://192.168.1.72"></b></font><font color="red"><b>MailScanner has detected a possible fraud attempt from "192.168.1.72" claiming to be</b></font> <font color="red"><b>MailScanner warning: numerical links are often malicious: 192.168.1.72</a></font></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt"><font face="Times New Roman"><b style="mso-bidi-font-weight: normal">Mar 17 10:08:47 linuxserver pluto[5747]:</b> "roadwarrior"[1] <a href="http://192.168.1.72"></b></font><font color="red"><b>MailScanner has detected a possible fraud attempt from "192.168.1.72" claiming to be</b></font> <font color="red"><b>MailScanner warning: numerical links are often malicious:
192.168.1.72</a> #1: transition from state STATE_MAIN_R0 to state STATE_MAIN_R1</font></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt"><font face="Times New Roman"><b style="mso-bidi-font-weight: normal">Mar 17 10:08:47 linuxserver pluto[5747]:</b> "roadwarrior"[1] <a href="http://192.168.1.72"></b></font><font color="red"><b>MailScanner has detected a possible fraud attempt from "192.168.1.72" claiming to be</b></font> <font color="red"><b>MailScanner warning: numerical links are often malicious:
192.168.1.72</a> #1: STATE_MAIN_R1: sent MR1, expecting MI2</font></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt"><font face="Times New Roman"><b style="mso-bidi-font-weight: normal">Mar 17 10:08:47 linuxserver pluto[5747]:</b> "roadwarrior"[1] <a href="http://192.168.1.72"></b></font><font color="red"><b>MailScanner has detected a possible fraud attempt from "192.168.1.72" claiming to be</b></font> <font color="red"><b>MailScanner warning: numerical links are often malicious:
192.168.1.72</a> #1: NAT-Traversal: Result using draft-ietf-ipsec-nat-t-ike-02/03: i am NATed</font></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt"><font face="Times New Roman"><b style="mso-bidi-font-weight: normal">Mar 17 10:08:47 linuxserver pluto[5747]:</b> "roadwarrior"[1] <a href="http://192.168.1.72"></b></font><font color="red"><b>MailScanner has detected a possible fraud attempt from "192.168.1.72" claiming to be</b></font> <font color="red"><b>MailScanner warning: numerical links are often malicious:
192.168.1.72</a> #1: transition from state STATE_MAIN_R1 to state STATE_MAIN_R2</font></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt"><font face="Times New Roman"><b style="mso-bidi-font-weight: normal">Mar 17 10:08:47 linuxserver pluto[5747]</b>: "roadwarrior"[1] <a href="http://192.168.1.72"></b></font><font color="red"><b>MailScanner has detected a possible fraud attempt from "192.168.1.72" claiming to be</b></font> <font color="red"><b>MailScanner warning: numerical links are often malicious:
192.168.1.72</a> #1: STATE_MAIN_R2: sent MR2, expecting MI3</font></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt"><font face="Times New Roman"><b style="mso-bidi-font-weight: normal">Mar 17 10:08:47 linuxserver pluto[5747]:</b> "roadwarrior"[1] <a href="http://192.168.1.72"></b></font><font color="red"><b>MailScanner has detected a possible fraud attempt from "192.168.1.72" claiming to be</b></font> <font color="red"><b>MailScanner warning: numerical links are often malicious:
192.168.1.72</a> #1: Main mode peer ID is ID_DER_ASN1_DN: 'C=CA, ST=Ontario, O=Springboard Retail Networks Inc., CN=laptop, E=<a href="mailto:laptop@springboardnetworks.com">laptop@springboardnetworks.com</a>'</font></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt"><font face="Times New Roman"><b style="mso-bidi-font-weight: normal">Mar 17 10:08:47 linuxserver pluto[5747]:</b> "roadwarrior"[2] <a href="http://192.168.1.72"></b></font><font color="red"><b>MailScanner has detected a possible fraud attempt from "192.168.1.72" claiming to be</b></font> <font color="red"><b>MailScanner warning: numerical links are often malicious:
192.168.1.72</a> #1: deleting connection "roadwarrior" instance with peer <a href="http://192.168.1.72"></b></font><font color="red"><b>MailScanner has detected a possible fraud attempt from "192.168.1.72" claiming to be</b></font> <font color="red"><b>MailScanner warning: numerical links are often malicious: 192.168.1.72</a> {isakmp=#0/ipsec=#0}</font></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt"><font face="Times New Roman"><b style="mso-bidi-font-weight: normal">Mar 17 10:08:47 linuxserver pluto[5747]</b>: "roadwarrior"[2] <a href="http://192.168.1.72"></b></font><font color="red"><b>MailScanner has detected a possible fraud attempt from "192.168.1.72" claiming to be</b></font> <font color="red"><b>MailScanner warning: numerical links are often malicious:
192.168.1.72</a> #1: I am sending my cert</font></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt"><font face="Times New Roman"><b style="mso-bidi-font-weight: normal">Mar 17 10:08:47 linuxserver pluto[5747]:</b> "roadwarrior"[2] <a href="http://192.168.1.72"></b></font><font color="red"><b>MailScanner has detected a possible fraud attempt from "192.168.1.72" claiming to be</b></font> <font color="red"><b>MailScanner warning: numerical links are often malicious:
192.168.1.72</a> #1: transition from state STATE_MAIN_R2 to state STATE_MAIN_R3</font></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt"><font face="Times New Roman"><b style="mso-bidi-font-weight: normal">Mar 17 10:08:47 linuxserver pluto[5747]: </b>| NAT-T: new mapping <a href="http://192.168.1.72:500/4500"></b></font><font color="red"><b>MailScanner has detected a possible fraud attempt from "192.168.1.72:500" claiming to be</b></font> <font color="red"><b>MailScanner warning: numerical links are often malicious:
192.168.1.72:500/4500</a>)</font></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt"><font face="Times New Roman"><b style="mso-bidi-font-weight: normal">Mar 17 10:08:47 linuxserver pluto[5747]:</b> "roadwarrior"[2] <a href="http://192.168.1.72"></b></font><font color="red"><b>MailScanner has detected a possible fraud attempt from "192.168.1.72" claiming to be</b></font> <font color="red"><b>MailScanner warning: numerical links are often malicious:
192.168.1.72</a> #1: STATE_MAIN_R3: sent MR3, ISAKMP SA established {auth=OAKLEY_RSA_SIG cipher=oakley_3des_cbc_192 prf=oakley_sha group=modp1024}</font></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt"><font face="Times New Roman"><b style="mso-bidi-font-weight: normal">Mar 17 10:08:48 linuxserver pluto[5747]:</b> "roadwarrior-net"[1] <a href="http://192.168.1.72"></b></font><font color="red"><b>MailScanner has detected a possible fraud attempt from "192.168.1.72" claiming to be</b></font> <font color="red"><b>MailScanner warning: numerical links are often malicious:
192.168.1.72</a> #2: responding to Quick Mode {msgid:cd161ee4}</font></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt"><font face="Times New Roman"><b style="mso-bidi-font-weight: normal">Mar 17 10:08:48 linuxserver pluto[5747]:</b> "roadwarrior-net"[1] <a href="http://192.168.1.72"></b></font><font color="red"><b>MailScanner has detected a possible fraud attempt from "192.168.1.72" claiming to be</b></font> <font color="red"><b>MailScanner warning: numerical links are often malicious:
192.168.1.72</a> #2: transition from state STATE_QUICK_R0 to state STATE_QUICK_R1</font></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt"><font face="Times New Roman"><b style="mso-bidi-font-weight: normal">Mar 17 10:08:48 linuxserver pluto[5747]:</b> "roadwarrior-net"[1] <a href="http://192.168.1.72"></b></font><font color="red"><b>MailScanner has detected a possible fraud attempt from "192.168.1.72" claiming to be</b></font> <font color="red"><b>MailScanner warning: numerical links are often malicious:
192.168.1.72</a> #2: STATE_QUICK_R1: sent QR1, inbound IPsec SA installed, expecting QI2</font></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt"><font face="Times New Roman"><b style="mso-bidi-font-weight: normal">Mar 17 10:08:48 linuxserver pluto[5747]:</b> "roadwarrior-net"[1] <a href="http://192.168.1.72"></b></font><font color="red"><b>MailScanner has detected a possible fraud attempt from "192.168.1.72" claiming to be</b></font> <font color="red"><b>MailScanner warning: numerical links are often malicious:
192.168.1.72</a> #2: transition from state STATE_QUICK_R1 to state STATE_QUICK_R2</font></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt"><font face="Times New Roman"><b style="mso-bidi-font-weight: normal">Mar 17 10:08:48 linuxserver pluto[5747]:</b> "roadwarrior-net"[1] <a href="http://192.168.1.72"></b></font><font color="red"><b>MailScanner has detected a possible fraud attempt from "192.168.1.72" claiming to be</b></font> <font color="red"><b>MailScanner warning: numerical links are often malicious:
192.168.1.72</a> #2: STATE_QUICK_R2: IPsec SA established {ESP=>0x6f52b75c <0x57d602e4 xfrm=3DES_0-HMAC_MD5 NATD=<a href="http://192.168.1.72:4500"></b></font><font color="red"><b>MailScanner has detected a possible fraud attempt from "192.168.1.72:4500" claiming to be</b></font> <font color="red"><b>MailScanner warning: numerical links are often malicious: 192.168.1.72:4500</a> DPD=none}</font></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt"><font face="Times New Roman"><b style="mso-bidi-font-weight: normal">Mar 17 10:11:03 linuxserver pluto[5747]</b>: "roadwarrior"[2] <a href="http://192.168.1.72"></b></font><font color="red"><b>MailScanner has detected a possible fraud attempt from "192.168.1.72" claiming to be</b></font> <font color="red"><b>MailScanner warning: numerical links are often malicious:
192.168.1.72</a> #1: received Delete SA(0x6f52b75c) payload: deleting IPSEC State #2</font></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt"><font face="Times New Roman"><b style="mso-bidi-font-weight: normal">Mar 17 10:11:03 linuxserver pluto[5747]:</b> "roadwarrior"[2] <a href="http://192.168.1.72"></b></font><font color="red"><b>MailScanner has detected a possible fraud attempt from "192.168.1.72" claiming to be</b></font> <font color="red"><b>MailScanner warning: numerical links are often malicious:
192.168.1.72</a> #1: deleting connection "roadwarrior-net" instance with peer <a href="http://192.168.1.72"></b></font><font color="red"><b>MailScanner has detected a possible fraud attempt from "192.168.1.72" claiming to be</b></font> <font color="red"><b>MailScanner warning: numerical links are often malicious: 192.168.1.72</a> {isakmp=#0/ipsec=#0}</font></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt"><font face="Times New Roman"><b style="mso-bidi-font-weight: normal">Mar 17 10:11:03 linuxserver pluto[5747]:</b> "roadwarrior"[2] <a href="http://192.168.1.72"></b></font><font color="red"><b>MailScanner has detected a possible fraud attempt from "192.168.1.72" claiming to be</b></font> <font color="red"><b>MailScanner warning: numerical links are often malicious:
192.168.1.72</a> #1: received and ignored informational message</font></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt"><font face="Times New Roman"><b style="mso-bidi-font-weight: normal">Mar 17 10:11:03 linuxserver pluto[5747]:</b> "roadwarrior"[2] <a href="http://192.168.1.72"></b></font><font color="red"><b>MailScanner has detected a possible fraud attempt from "192.168.1.72" claiming to be</b></font> <font color="red"><b>MailScanner warning: numerical links are often malicious:
192.168.1.72</a> #1: received Delete SA payload: deleting ISAKMP State #1</font></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt"><font face="Times New Roman"><b style="mso-bidi-font-weight: normal">Mar 17 10:11:03 linuxserver pluto[5747]:</b> "roadwarrior"[2] <a href="http://192.168.1.72"></b></font><font color="red"><b>MailScanner has detected a possible fraud attempt from "192.168.1.72" claiming to be</b></font> <font color="red"><b>MailScanner warning: numerical links are often malicious:
192.168.1.72</a>: deleting connection "roadwarrior" instance with peer <a href="http://192.168.1.72"></b></font><font color="red"><b>MailScanner has detected a possible fraud attempt from "192.168.1.72" claiming to be</b></font> <font color="red"><b>MailScanner warning: numerical links are often malicious: 192.168.1.72</a> {isakmp=#0/ipsec=#0}</font></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt"><font face="Times New Roman"><b style="mso-bidi-font-weight: normal">Mar 17 10:11:03 linuxserver pluto[5747]:</b> packet from <a href="http://192.168.1.72:4500"></b></font><font color="red"><b>MailScanner has detected a possible fraud attempt from "192.168.1.72:4500" claiming to be</b></font> <font color="red"><b>MailScanner warning: numerical links are often malicious: 192.168.1.72:4500
</a>: received and ignored informational message</font></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt"><font face="Times New Roman"> </font></p></div>
<div> </div>
<div> </div>
<div> </div>
<div> </div>
<div> </div>
<div> </div>
<div> </div>
<div>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>> HERE IS THE LOG FILE FROM oakley.log<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<
<br><br>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt"><font face="Times New Roman">3-17: 10:08:25:312:f24 Initialization OK</font></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt"><font face="Times New Roman"><span style="mso-spacerun: yes"> </span>3-17: 10:08:28:812:b0c Acquire from driver: op=00000006 src=192.168.1.72.0 dst=10.10.10.10.0 proto = 0, SrcMask=
<a href="http://255.255.255.255"></b></font><font color="red"><b>MailScanner has detected a possible fraud attempt from "255.255.255.255" claiming to be</b></font> <font color="red"><b>MailScanner warning: numerical links are often malicious: 255.255.255.255</a>, DstMask=<a href="http://255.255.255.0"></b></font><font color="red"><b>MailScanner has detected a possible fraud attempt from "255.255.255.0" claiming to be</b></font> <font color="red"><b>MailScanner warning: numerical links are often malicious: 255.255.255.0</a>, Tunnel 1, TunnelEndpt=<a href="http://192.168.1.55"></b></font><font color="red"><b>MailScanner has detected a possible fraud attempt from "192.168.1.55" claiming to be</b></font> <font color="red"><b>MailScanner warning: numerical links are often malicious: 192.168.1.55</a> Inbound TunnelEndpt=<a href="http://192.168.1.72"></b></font><font color="red"><b>MailScanner has detected a possible fraud attempt from "192.168.1.72" claiming to be</b></font> <font color="red"><b>MailScanner warning: numerical links are often malicious:
192.168.1.72</a></font></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt"><font face="Times New Roman"><span style="mso-spacerun: yes"> </span>3-17: 10:08:28:812:4a8 Filter to match: Src <a href="http://192.168.1.55"></b></font><font color="red"><b>MailScanner has detected a possible fraud attempt from "192.168.1.55" claiming to be</b></font> <font color="red"><b>MailScanner warning: numerical links are often malicious: 192.168.1.55</a> Dst <a href="http://192.168.1.72"></b></font><font color="red"><b>MailScanner has detected a possible fraud attempt from "192.168.1.72" claiming to be</b></font> <font color="red"><b>MailScanner warning: numerical links are often malicious:
192.168.1.72</a></font></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt"><font face="Times New Roman"><span style="mso-spacerun: yes"> </span>3-17: 10:08:28:843:4a8 MM PolicyName: 1</font></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt"><font face="Times New Roman"><span style="mso-spacerun: yes"> </span>3-17: 10:08:28:843:4a8 MMPolicy dwFlags 2 SoftSAExpireTime 3500</font></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt"><font face="Times New Roman"><span style="mso-spacerun: yes"> </span>3-17: 10:08:28:843:4a8 MMOffer[0] LifetimeSec 3500 QMLimit 0 DHGroup 2</font></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt"><font face="Times New Roman"><span style="mso-spacerun: yes"> </span>3-17: 10:08:28:843:4a8 MMOffer[0] Encrypt: Triple DES CBC Hash: SHA</font></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt"><font face="Times New Roman"><span style="mso-spacerun: yes"> </span>3-17: 10:08:28:859:4a8 Auth[0]:RSA Sig C=CA, S=Ontario, L=Toronto, O=Springboard Retail Networks Inc., CN=OzgUN, E=
<a href="mailto:ozgun@springboardnetworks.com">ozgun@springboardnetworks.com</a> AuthFlags 0</font></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt"><font face="Times New Roman"><span style="mso-spacerun: yes"> </span>3-17: 10:08:28:859:4a8 QM PolicyName: x4 {896ab29d-cdc1-4e6f-aadf-474aae37fad3} dwFlags 1</font></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt"><font face="Times New Roman"><span style="mso-spacerun: yes"> </span>3-17: 10:08:28:859:4a8 QMOffer[0] LifetimeKBytes 0 LifetimeSec 0</font></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt"><font face="Times New Roman"><span style="mso-spacerun: yes"> </span>3-17: 10:08:28:859:4a8 QMOffer[0] dwFlags 0 dwPFSGroup -2147483648</font></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt"><font face="Times New Roman"><span style="mso-spacerun: yes"> </span>3-17: 10:08:28:859:4a8<span style="mso-spacerun: yes"> </span>Algo[0] Operation: ESP Algo: Triple DES CBC HMAC: MD5
</font></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt"><font face="Times New Roman"><span style="mso-spacerun: yes"> </span>3-17: 10:08:28:859:4a8 Starting Negotiation: src = 192.168.1.72.0500, dst = 192.168.1.55.0500, proto = 00, context = 00000006, ProxySrc =
192.168.1.72.0000, ProxyDst = 10.10.10.0.0000 SrcMask = <a href="http://255.255.255.255"></b></font><font color="red"><b>MailScanner has detected a possible fraud attempt from "255.255.255.255" claiming to be</b></font> <font color="red"><b>MailScanner warning: numerical links are often malicious: 255.255.255.255</a> DstMask = <a href="http://255.255.255.0"></b></font><font color="red"><b>MailScanner has detected a possible fraud attempt from "255.255.255.0" claiming to be</b></font> <font color="red"><b>MailScanner warning: numerical links are often malicious: 255.255.255.0</a></font></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt"><font face="Times New Roman"><span style="mso-spacerun: yes"> </span>3-17: 10:08:28:859:4a8 constructing ISAKMP Header</font></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt"><font face="Times New Roman"><span style="mso-spacerun: yes"> </span>3-17: 10:08:28:859:4a8 constructing SA (ISAKMP)</font></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt"><font face="Times New Roman"><span style="mso-spacerun: yes"> </span>3-17: 10:08:28:859:4a8 Constructing Vendor MS NT5 ISAKMPOAKLEY</font></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt"><font face="Times New Roman"><span style="mso-spacerun: yes"> </span>3-17: 10:08:28:859:4a8 Constructing Vendor FRAGMENTATION</font></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt"><font face="Times New Roman"><span style="mso-spacerun: yes"> </span>3-17: 10:08:28:859:4a8 Constructing Vendor draft-ietf-ipsec-nat-t-ike-02</font></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt"><font face="Times New Roman"><span style="mso-spacerun: yes"> </span>3-17: 10:08:28:859:4a8 Constructing Vendor Vid-Initial-Contact</font></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt"><font face="Times New Roman"><span style="mso-spacerun: yes"> </span>3-17: 10:08:28:859:4a8 </font></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt"><font face="Times New Roman"><span style="mso-spacerun: yes"> </span>3-17: 10:08:28:859:4a8 Sending: SA = 0x00103838 to 192.168.1.55:Type 2.500</font></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt"><font face="Times New Roman"><span style="mso-spacerun: yes"> </span>3-17: 10:08:28:859:4a8 ISAKMP Header: (V1.0), len = 168</font></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt"><font face="Times New Roman"><span style="mso-spacerun: yes"> </span>3-17: 10:08:28:859:4a8<span style="mso-spacerun: yes"> </span>I-COOKIE 9b3cc29bc2a91b7b</font></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt"><font face="Times New Roman"><span style="mso-spacerun: yes"> </span>3-17: 10:08:28:859:4a8<span style="mso-spacerun: yes"> </span>R-COOKIE 0000000000000000</font></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt"><font face="Times New Roman"><span style="mso-spacerun: yes"> </span>3-17: 10:08:28:859:4a8<span style="mso-spacerun: yes"> </span>exchange: Oakley Main Mode</font></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt"><font face="Times New Roman"><span style="mso-spacerun: yes"> </span>3-17: 10:08:28:859:4a8<span style="mso-spacerun: yes"> </span>flags: 0</font></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt"><font face="Times New Roman"><span style="mso-spacerun: yes"> </span>3-17: 10:08:28:859:4a8<span style="mso-spacerun: yes"> </span>next payload: SA</font></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt"><font face="Times New Roman"><span style="mso-spacerun: yes"> </span>3-17: 10:08:28:859:4a8<span style="mso-spacerun: yes"> </span>message ID: 00000000</font></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt"><font face="Times New Roman"><span style="mso-spacerun: yes"> </span>3-17: 10:08:28:859:4a8 Ports S:f401 D:f401</font></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt"><font face="Times New Roman"><span style="mso-spacerun: yes"> </span>3-17: 10:08:28:859:4a8 </font></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt"><font face="Times New Roman"><span style="mso-spacerun: yes"> </span>3-17: 10:08:28:859:4a8 Receive: (get) SA = 0x00103838 from 192.168.1.55.500</font></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt"><font face="Times New Roman"><span style="mso-spacerun: yes"> </span>3-17: 10:08:28:859:4a8 ISAKMP Header: (V1.0), len = 140</font></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt"><font face="Times New Roman"><span style="mso-spacerun: yes"> </span>3-17: 10:08:28:859:4a8<span style="mso-spacerun: yes"> </span>I-COOKIE 9b3cc29bc2a91b7b</font></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt"><font face="Times New Roman"><span style="mso-spacerun: yes"> </span>3-17: 10:08:28:859:4a8<span style="mso-spacerun: yes"> </span>R-COOKIE fa8d7979591c3d4f</font></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt"><font face="Times New Roman"><span style="mso-spacerun: yes"> </span>3-17: 10:08:28:859:4a8<span style="mso-spacerun: yes"> </span>exchange: Oakley Main Mode</font></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt"><font face="Times New Roman"><span style="mso-spacerun: yes"> </span>3-17: 10:08:28:859:4a8<span style="mso-spacerun: yes"> </span>flags: 0</font></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt"><font face="Times New Roman"><span style="mso-spacerun: yes"> </span>3-17: 10:08:28:859:4a8<span style="mso-spacerun: yes"> </span>next payload: SA</font></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt"><font face="Times New Roman"><span style="mso-spacerun: yes"> </span>3-17: 10:08:28:859:4a8<span style="mso-spacerun: yes"> </span>message ID: 00000000</font></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt"><font face="Times New Roman"><span style="mso-spacerun: yes"> </span>3-17: 10:08:28:859:4a8 processing payload SA</font></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt"><font face="Times New Roman"><span style="mso-spacerun: yes"> </span>3-17: 10:08:28:859:4a8 Received Phase 1 Transform 1</font></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt"><font face="Times New Roman"><span style="mso-spacerun: yes"> </span>3-17: 10:08:28:859:4a8<span style="mso-spacerun: yes"> </span>Encryption Alg Triple DES CBC(5)</font>
</p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt"><font face="Times New Roman"><span style="mso-spacerun: yes"> </span>3-17: 10:08:28:859:4a8<span style="mso-spacerun: yes"> </span>Hash Alg SHA(2)</font></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt"><font face="Times New Roman"><span style="mso-spacerun: yes"> </span>3-17: 10:08:28:859:4a8<span style="mso-spacerun: yes"> </span>Oakley Group 2</font></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt"><font face="Times New Roman"><span style="mso-spacerun: yes"> </span>3-17: 10:08:28:859:4a8<span style="mso-spacerun: yes"> </span>Auth Method RSA Signature with Certificates(3)
</font></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt"><font face="Times New Roman"><span style="mso-spacerun: yes"> </span>3-17: 10:08:28:859:4a8<span style="mso-spacerun: yes"> </span>Life type in Seconds</font></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt"><font face="Times New Roman"><span style="mso-spacerun: yes"> </span>3-17: 10:08:28:859:4a8<span style="mso-spacerun: yes"> </span>Life duration of 3500</font></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt"><font face="Times New Roman"><span style="mso-spacerun: yes"> </span>3-17: 10:08:28:859:4a8 Phase 1 SA accepted: transform=1</font></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt"><font face="Times New Roman"><span style="mso-spacerun: yes"> </span>3-17: 10:08:28:859:4a8 SA - Oakley proposal accepted</font></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt"><font face="Times New Roman"><span style="mso-spacerun: yes"> </span>3-17: 10:08:28:859:4a8 processing payload VENDOR ID</font></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt"><font face="Times New Roman"><span style="mso-spacerun: yes"> </span>3-17: 10:08:28:859:4a8 processing payload VENDOR ID</font></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt"><font face="Times New Roman"><span style="mso-spacerun: yes"> </span>3-17: 10:08:28:859:4a8 processing payload VENDOR ID</font></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt"><font face="Times New Roman"><span style="mso-spacerun: yes"> </span>3-17: 10:08:28:859:4a8 Received VendorId draft-ietf-ipsec-nat-t-ike-02</font></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt"><font face="Times New Roman"><span style="mso-spacerun: yes"> </span>3-17: 10:08:28:859:4a8 ClearFragList</font></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt"><font face="Times New Roman"><span style="mso-spacerun: yes"> </span>3-17: 10:08:28:859:4a8 constructing ISAKMP Header</font></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt"><font face="Times New Roman"><span style="mso-spacerun: yes"> </span>3-17: 10:08:28:906:4a8 constructing KE</font></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt"><font face="Times New Roman"><span style="mso-spacerun: yes"> </span>3-17: 10:08:28:906:4a8 constructing NONCE (ISAKMP)</font></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt"><font face="Times New Roman"><span style="mso-spacerun: yes"> </span>3-17: 10:08:28:906:4a8 Constructing NatDisc</font></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt"><font face="Times New Roman"><span style="mso-spacerun: yes"> </span>3-17: 10:08:28:906:4a8 </font></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt"><font face="Times New Roman"><span style="mso-spacerun: yes"> </span>3-17: 10:08:28:906:4a8 Sending: SA = 0x00103838 to 192.168.1.55:Type 2.500</font></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt"><font face="Times New Roman"><span style="mso-spacerun: yes"> </span>3-17: 10:08:28:906:4a8 ISAKMP Header: (V1.0), len = 232</font></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt"><font face="Times New Roman"><span style="mso-spacerun: yes"> </span>3-17: 10:08:28:906:4a8<span style="mso-spacerun: yes"> </span>I-COOKIE 9b3cc29bc2a91b7b</font></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt"><font face="Times New Roman"><span style="mso-spacerun: yes"> </span>3-17: 10:08:28:906:4a8<span style="mso-spacerun: yes"> </span>R-COOKIE fa8d7979591c3d4f</font></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt"><font face="Times New Roman"><span style="mso-spacerun: yes"> </span>3-17: 10:08:28:906:4a8<span style="mso-spacerun: yes"> </span>exchange: Oakley Main Mode</font></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt"><font face="Times New Roman"><span style="mso-spacerun: yes"> </span>3-17: 10:08:28:906:4a8<span style="mso-spacerun: yes"> </span>flags: 0</font></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt"><font face="Times New Roman"><span style="mso-spacerun: yes"> </span>3-17: 10:08:28:906:4a8 <span style="mso-spacerun: yes"> </span>next payload: KE</font></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt"><font face="Times New Roman"><span style="mso-spacerun: yes"> </span>3-17: 10:08:28:906:4a8<span style="mso-spacerun: yes"> </span>message ID: 00000000</font></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt"><font face="Times New Roman"><span style="mso-spacerun: yes"> </span>3-17: 10:08:28:906:4a8 Ports S:f401 D:f401</font></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt"><font face="Times New Roman"><span style="mso-spacerun: yes"> </span>3-17: 10:08:28:921:4a8 </font></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt"><font face="Times New Roman"><span style="mso-spacerun: yes"> </span>3-17: 10:08:28:921:4a8 Receive: (get) SA = 0x00103838 from 192.168.1.55.500</font></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt"><font face="Times New Roman"><span style="mso-spacerun: yes"> </span>3-17: 10:08:28:921:4a8 ISAKMP Header: (V1.0), len = 228</font></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt"><font face="Times New Roman"><span style="mso-spacerun: yes"> </span>3-17: 10:08:28:921:4a8<span style="mso-spacerun: yes"> </span>I-COOKIE 9b3cc29bc2a91b7b</font></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt"><font face="Times New Roman"><span style="mso-spacerun: yes"> </span>3-17: 10:08:28:921:4a8<span style="mso-spacerun: yes"> </span>R-COOKIE fa8d7979591c3d4f</font></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt"><font face="Times New Roman"><span style="mso-spacerun: yes"> </span>3-17: 10:08:28:921:4a8<span style="mso-spacerun: yes"> </span>exchange: Oakley Main Mode</font></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt"><font face="Times New Roman"><span style="mso-spacerun: yes"> </span>3-17: 10:08:28:921:4a8<span style="mso-spacerun: yes"> </span>flags: 0</font></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt"><font face="Times New Roman"><span style="mso-spacerun: yes"> </span>3-17: 10:08:28:921:4a8<span style="mso-spacerun: yes"> </span>next payload: KE</font></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt"><font face="Times New Roman"><span style="mso-spacerun: yes"> </span>3-17: 10:08:28:921:4a8<span style="mso-spacerun: yes"> </span>message ID: 00000000</font></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt"><font face="Times New Roman"><span style="mso-spacerun: yes"> </span>3-17: 10:08:28:921:4a8 processing payload KE</font></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt"><font face="Times New Roman"><span style="mso-spacerun: yes"> </span>3-17: 10:08:28:937:4a8 processing payload NONCE</font></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt"><font face="Times New Roman"><span style="mso-spacerun: yes"> </span>3-17: 10:08:28:937:4a8 processing payload NATDISC</font></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt"><font face="Times New Roman"><span style="mso-spacerun: yes"> </span>3-17: 10:08:28:937:4a8 Processing NatHash</font></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt"><font face="Times New Roman"><span style="mso-spacerun: yes"> </span>3-17: 10:08:28:937:4a8 Nat hash 3c4932af28025499da8acacbca96aeef</font></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt"><font face="Times New Roman"><span style="mso-spacerun: yes"> </span>3-17: 10:08:28:937:4a8 3d70fcee</font></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt"><font face="Times New Roman"><span style="mso-spacerun: yes"> </span>3-17: 10:08:28:937:4a8 SA StateMask2 f</font></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt"><font face="Times New Roman"><span style="mso-spacerun: yes"> </span>3-17: 10:08:28:937:4a8 processing payload NATDISC</font></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt"><font face="Times New Roman"><span style="mso-spacerun: yes"> </span>3-17: 10:08:28:937:4a8 Processing NatHash</font></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt"><font face="Times New Roman"><span style="mso-spacerun: yes"> </span>3-17: 10:08:28:937:4a8 Nat hash 7863a10d421512bd263dcf3009ea8c55</font></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt"><font face="Times New Roman"><span style="mso-spacerun: yes"> </span>3-17: 10:08:28:937:4a8 8a31c932</font></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt"><font face="Times New Roman"><span style="mso-spacerun: yes"> </span>3-17: 10:08:28:937:4a8 SA StateMask2 4f</font></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt"><font face="Times New Roman"><span style="mso-spacerun: yes"> </span>3-17: 10:08:28:937:4a8 ClearFragList</font></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt"><font face="Times New Roman"><span style="mso-spacerun: yes"> </span>3-17: 10:08:28:937:4a8 Peer behind NAT</font></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt"><font face="Times New Roman"><span style="mso-spacerun: yes"> </span>3-17: 10:08:28:937:4a8 Floated Ports Orig Me:f401 Peer:f401</font></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt"><font face="Times New Roman"><span style="mso-spacerun: yes"> </span>3-17: 10:08:28:937:4a8 Floated Ports Me:9411 Peer:9411</font></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt"><font face="Times New Roman"><span style="mso-spacerun: yes"> </span>3-17: 10:08:28:937:4a8 constructing ISAKMP Header</font></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt"><font face="Times New Roman"><span style="mso-spacerun: yes"> </span>3-17: 10:08:28:937:4a8 constructing ID</font></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt"><font face="Times New Roman"><span style="mso-spacerun: yes"> </span>3-17: 10:08:28:937:4a8 Received no valid CRPs.<span style="mso-spacerun: yes"> </span>Using all configured
</font></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt"><font face="Times New Roman"><span style="mso-spacerun: yes"> </span>3-17: 10:08:28:937:4a8 Looking for IPSec only cert</font></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt"><font face="Times New Roman"><span style="mso-spacerun: yes"> </span>3-17: 10:08:28:968:4a8 Cert Trustes.<span style="mso-spacerun: yes"> </span>0 100</font></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt"><font face="Times New Roman"><span style="mso-spacerun: yes"> </span>3-17: 10:08:28:968:4a8 Cert SHA Thumbprint 9f120fd256be49e28c1df547aef9a125</font></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt"><font face="Times New Roman"><span style="mso-spacerun: yes"> </span>3-17: 10:08:28:968:4a8 6ebef09e</font></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt"><font face="Times New Roman"><span style="mso-spacerun: yes"> </span>3-17: 10:08:28:968:4a8 CertFindExtenstion failed with 0</font></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt"><font face="Times New Roman"><span style="mso-spacerun: yes"> </span>3-17: 10:08:29:78:4a8 Entered CRL check</font></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt"><font face="Times New Roman"><span style="mso-spacerun: yes"> </span>3-17: 10:08:29:93:4a8 Left CRL check</font></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt"><font face="Times New Roman"><span style="mso-spacerun: yes"> </span>3-17: 10:08:29:93:4a8 Cert SHA Thumbprint 9f120fd256be49e28c1df547aef9a125</font></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt"><font face="Times New Roman"><span style="mso-spacerun: yes"> </span>3-17: 10:08:29:93:4a8 6ebef09e</font></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt"><font face="Times New Roman"><span style="mso-spacerun: yes"> </span>3-17: 10:08:29:93:4a8 SubjectName: C=CA, S=Ontario, O=Springboard Retail Networks Inc., CN=laptop, E=<a href="mailto:laptop@springboardnetworks.com">
laptop@springboardnetworks.com</a></font></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt"><font face="Times New Roman"><span style="mso-spacerun: yes"> </span>3-17: 10:08:29:93:4a8 Cert Serialnumber 02</font></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt"><font face="Times New Roman"><span style="mso-spacerun: yes"> </span>3-17: 10:08:29:93:4a8 Cert SHA Thumbprint 9f120fd256be49e28c1df547aef9a125</font></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt"><font face="Times New Roman"><span style="mso-spacerun: yes"> </span>3-17: 10:08:29:93:4a8 6ebef09e</font></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt"><font face="Times New Roman"><span style="mso-spacerun: yes"> </span>3-17: 10:08:29:93:4a8 SubjectName: C=CA, S=Ontario, L=Toronto, O=Springboard Retail Networks Inc., CN=OzgUN, E=
<a href="mailto:ozgun@springboardnetworks.com">ozgun@springboardnetworks.com</a></font></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt"><font face="Times New Roman"><span style="mso-spacerun: yes"> </span>3-17: 10:08:29:93:4a8 Cert Serialnumber 7ce887a3f0e91dc800</font></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt"><font face="Times New Roman"><span style="mso-spacerun: yes"> </span>3-17: 10:08:29:93:4a8 Cert SHA Thumbprint f248c0125dda62bb3fa6c304e1784f8f</font></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt"><font face="Times New Roman"><span style="mso-spacerun: yes"> </span>3-17: 10:08:29:93:4a8 0225315f</font></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt"><font face="Times New Roman"><span style="mso-spacerun: yes"> </span>3-17: 10:08:29:93:4a8 Not storing My cert chain in SA.</font></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt"><font face="Times New Roman"><span style="mso-spacerun: yes"> </span>3-17: 10:08:29:93:4a8 MM ID Type 9</font></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt"><font face="Times New Roman"><span style="mso-spacerun: yes"> </span>3-17: 10:08:29:93:4a8 MM ID 30818a310b3009060355040613024341</font></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt"><font face="Times New Roman"><span style="mso-spacerun: yes"> </span>3-17: 10:08:29:93:4a8 3110300e060355040813074f6e746172</font></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt"><font face="Times New Roman"><span style="mso-spacerun: yes"> </span>3-17: 10:08:29:93:4a8 696f31293027060355040a1320537072</font></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt"><font face="Times New Roman"><span style="mso-spacerun: yes"> </span>3-17: 10:08:29:93:4a8 696e67626f6172642052657461696c20</font></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt"><font face="Times New Roman"><span style="mso-spacerun: yes"> </span>3-17: 10:08:29:93:4a8 4e6574776f726b7320496e632e310f30</font></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt"><font face="Times New Roman"><span style="mso-spacerun: yes"> </span>3-17: 10:08:29:93:4a8 0d060355040313066c6170746f70312d</font></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt"><font face="Times New Roman"><span style="mso-spacerun: yes"> </span>3-17: 10:08:29:93:4a8 302b06092a864886f70d010901161e6c</font></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt"><font face="Times New Roman"><span style="mso-spacerun: yes"> </span>3-17: 10:08:29:93:4a8 6170746f7040737072696e67626f6172</font></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt"><font face="Times New Roman"><span style="mso-spacerun: yes"> </span>3-17: 10:08:29:93:4a8 646e6574776f726b732e636f6d</font></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt"><font face="Times New Roman"><span style="mso-spacerun: yes"> </span>3-17: 10:08:29:93:4a8 constructing CERT</font></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt"><font face="Times New Roman"><span style="mso-spacerun: yes"> </span>3-17: 10:08:29:93:4a8 Construct SIG</font></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt"><font face="Times New Roman"><span style="mso-spacerun: yes"> </span>3-17: 10:08:29:93:4a8 Constructing Cert Request</font></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt"><font face="Times New Roman"><span style="mso-spacerun: yes"> </span>3-17: 10:08:29:93:4a8 C=CA, S=Ontario, L=Toronto, O=Springboard Retail Networks Inc., CN=OzgUN, E=<a href="mailto:ozgun@springboardnetworks.com">
ozgun@springboardnetworks.com</a></font></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt"><font face="Times New Roman"><span style="mso-spacerun: yes"> </span>3-17: 10:08:29:93:4a8 </font></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt"><font face="Times New Roman"><span style="mso-spacerun: yes"> </span>3-17: 10:08:29:93:4a8 Sending: SA = 0x00103838 to 192.168.1.55:Type 2.4500</font></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt"><font face="Times New Roman"><span style="mso-spacerun: yes"> </span>3-17: 10:08:29:93:4a8 ISAKMP Header: (V1.0), len = 1452</font></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt"><font face="Times New Roman"><span style="mso-spacerun: yes"> </span>3-17: 10:08:29:93:4a8<span style="mso-spacerun: yes"> </span>I-COOKIE 9b3cc29bc2a91b7b</font></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt"><font face="Times New Roman"><span style="mso-spacerun: yes"> </span>3-17: 10:08:29:93:4a8<span style="mso-spacerun: yes"> </span>R-COOKIE fa8d7979591c3d4f</font></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt"><font face="Times New Roman"><span style="mso-spacerun: yes"> </span>3-17: 10:08:29:93:4a8<span style="mso-spacerun: yes"> </span>exchange: Oakley Main Mode</font></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt"><font face="Times New Roman"><span style="mso-spacerun: yes"> </span>3-17: 10:08:29:93:4a8<span style="mso-spacerun: yes"> </span>flags: 1 ( encrypted )</font></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt"><font face="Times New Roman"><span style="mso-spacerun: yes"> </span>3-17: 10:08:29:93:4a8<span style="mso-spacerun: yes"> </span>next payload: ID</font></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt"><font face="Times New Roman"><span style="mso-spacerun: yes"> </span>3-17: 10:08:29:93:4a8<span style="mso-spacerun: yes"> </span>message ID: 00000000</font></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt"><font face="Times New Roman"><span style="mso-spacerun: yes"> </span>3-17: 10:08:29:93:4a8 Ports S:9411 D:9411</font></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt"><font face="Times New Roman"><span style="mso-spacerun: yes"> </span>3-17: 10:08:29:109:4a8 </font></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt"><font face="Times New Roman"><span style="mso-spacerun: yes"> </span>3-17: 10:08:29:109:4a8 Receive: (get) SA = 0x00103838 from 192.168.1.55.4500</font></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt"><font face="Times New Roman"><span style="mso-spacerun: yes"> </span>3-17: 10:08:29:109:4a8 ISAKMP Header: (V1.0), len = 1348</font></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt"><font face="Times New Roman"><span style="mso-spacerun: yes"> </span>3-17: 10:08:29:109:4a8<span style="mso-spacerun: yes"> </span>I-COOKIE 9b3cc29bc2a91b7b</font></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt"><font face="Times New Roman"><span style="mso-spacerun: yes"> </span>3-17: 10:08:29:109:4a8<span style="mso-spacerun: yes"> </span>R-COOKIE fa8d7979591c3d4f</font></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt"><font face="Times New Roman"><span style="mso-spacerun: yes"> </span>3-17: 10:08:29:109:4a8<span style="mso-spacerun: yes"> </span>exchange: Oakley Main Mode</font></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt"><font face="Times New Roman"><span style="mso-spacerun: yes"> </span>3-17: 10:08:29:109:4a8<span style="mso-spacerun: yes"> </span>flags: 1 ( encrypted )</font></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt"><font face="Times New Roman"><span style="mso-spacerun: yes"> </span>3-17: 10:08:29:109:4a8<span style="mso-spacerun: yes"> </span>next payload: ID</font></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt"><font face="Times New Roman"><span style="mso-spacerun: yes"> </span>3-17: 10:08:29:109:4a8<span style="mso-spacerun: yes"> </span>message ID: 00000000</font></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt"><font face="Times New Roman"><span style="mso-spacerun: yes"> </span>3-17: 10:08:29:109:4a8 processing payload ID</font></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt"><font face="Times New Roman"><span style="mso-spacerun: yes"> </span>3-17: 10:08:29:109:4a8 processing payload CERT</font></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt"><font face="Times New Roman"><span style="mso-spacerun: yes"> </span>3-17: 10:08:29:109:4a8 processing payload SIG</font></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt"><font face="Times New Roman"><span style="mso-spacerun: yes"> </span>3-17: 10:08:29:109:4a8 Verifying CertStore</font></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt"><font face="Times New Roman"><span style="mso-spacerun: yes"> </span>3-17: 10:08:29:109:4a8 SubjectName: C=CA, S=Ontario, L=Toronto, O=Internet Widgits Pty Ltd, OU=SRN, CN=deneme1, E=
<a href="mailto:deneme1@springboardnetworks.com">deneme1@springboardnetworks.com</a></font></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt"><font face="Times New Roman"><span style="mso-spacerun: yes"> </span>3-17: 10:08:29:109:4a8 Cert Serialnumber 01</font></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt"><font face="Times New Roman"><span style="mso-spacerun: yes"> </span>3-17: 10:08:29:109:4a8 Cert SHA Thumbprint 173111919eb4dc726dc3cf2f1d6e1d94</font></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt"><font face="Times New Roman"><span style="mso-spacerun: yes"> </span>3-17: 10:08:29:109:4a8 89f9e522</font></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt"><font face="Times New Roman"><span style="mso-spacerun: yes"> </span>3-17: 10:08:29:109:4a8 Cert Trustes.<span style="mso-spacerun: yes"> </span>0 100</font></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt"><font face="Times New Roman"><span style="mso-spacerun: yes"> </span>3-17: 10:08:29:109:4a8 SubjectName: C=CA, S=Ontario, L=Toronto, O=Internet Widgits Pty Ltd, OU=SRN, CN=deneme1, E=
<a href="mailto:deneme1@springboardnetworks.com">deneme1@springboardnetworks.com</a></font></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt"><font face="Times New Roman"><span style="mso-spacerun: yes"> </span>3-17: 10:08:29:109:4a8 Cert Serialnumber 01</font></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt"><font face="Times New Roman"><span style="mso-spacerun: yes"> </span>3-17: 10:08:29:109:4a8 Cert SHA Thumbprint 173111919eb4dc726dc3cf2f1d6e1d94</font></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt"><font face="Times New Roman"><span style="mso-spacerun: yes"> </span>3-17: 10:08:29:109:4a8 89f9e522</font></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt"><font face="Times New Roman"><span style="mso-spacerun: yes"> </span>3-17: 10:08:29:109:4a8 SubjectName: C=CA, S=Ontario, L=Toronto, O=Springboard Retail Networks Inc., CN=OzgUN, E=
<a href="mailto:ozgun@springboardnetworks.com">ozgun@springboardnetworks.com</a></font></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt"><font face="Times New Roman"><span style="mso-spacerun: yes"> </span>3-17: 10:08:29:109:4a8 Cert Serialnumber 7ce887a3f0e91dc800</font></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt"><font face="Times New Roman"><span style="mso-spacerun: yes"> </span>3-17: 10:08:29:109:4a8 Cert SHA Thumbprint f248c0125dda62bb3fa6c304e1784f8f</font></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt"><font face="Times New Roman"><span style="mso-spacerun: yes"> </span>3-17: 10:08:29:109:4a8 0225315f</font></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt"><font face="Times New Roman"><span style="mso-spacerun: yes"> </span>3-17: 10:08:29:109:4a8 Not storing Peer's cert chain in SA.</font></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt"><font face="Times New Roman"><span style="mso-spacerun: yes"> </span>3-17: 10:08:29:109:4a8 Cert SHA Thumbprint 173111919eb4dc726dc3cf2f1d6e1d94</font></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt"><font face="Times New Roman"><span style="mso-spacerun: yes"> </span>3-17: 10:08:29:109:4a8 89f9e522</font></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt"><font face="Times New Roman"><span style="mso-spacerun: yes"> </span>3-17: 10:08:29:109:4a8 Entered CRL check</font></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt"><font face="Times New Roman"><span style="mso-spacerun: yes"> </span>3-17: 10:08:29:109:4a8 Left CRL check</font></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt"><font face="Times New Roman"><span style="mso-spacerun: yes"> </span>3-17: 10:08:29:109:4a8 CertFindExtenstion failed with 0</font></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt"><font face="Times New Roman"><span style="mso-spacerun: yes"> </span>3-17: 10:08:29:109:4a8 Signature validated</font></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt"><font face="Times New Roman"><span style="mso-spacerun: yes"> </span>3-17: 10:08:29:109:4a8 ClearFragList</font></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt"><font face="Times New Roman"><span style="mso-spacerun: yes"> </span>3-17: 10:08:29:109:4a8 MM established.<span style="mso-spacerun: yes"> </span>SA: 00103838</font></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt"><font face="Times New Roman"><span style="mso-spacerun: yes"> </span>3-17: 10:08:29:109:4a8 QM PolicyName: x4 {896ab29d-cdc1-4e6f-aadf-474aae37fad3} dwFlags 1</font></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt"><font face="Times New Roman"><span style="mso-spacerun: yes"> </span>3-17: 10:08:29:109:4a8 QMOffer[0] LifetimeKBytes 0 LifetimeSec 0</font></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt"><font face="Times New Roman"><span style="mso-spacerun: yes"> </span>3-17: 10:08:29:109:4a8 QMOffer[0] dwFlags 0 dwPFSGroup -2147483648</font></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt"><font face="Times New Roman"><span style="mso-spacerun: yes"> </span>3-17: 10:08:29:109:4a8<span style="mso-spacerun: yes"> </span>Algo[0] Operation: ESP Algo: Triple DES CBC HMAC: MD5
</font></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt"><font face="Times New Roman"><span style="mso-spacerun: yes"> </span>3-17: 10:08:29:109:4a8 GetSpi: src = 10.10.10.0.0000, dst = 192.168.1.72.0000, proto = 00, context = 00000006, srcMask =
<a href="http://255.255.255.0"></b></font><font color="red"><b>MailScanner has detected a possible fraud attempt from "255.255.255.0" claiming to be</b></font> <font color="red"><b>MailScanner warning: numerical links are often malicious: 255.255.255.0</a>, destMask = <a href="http://255.255.255.255"></b></font><font color="red"><b>MailScanner has detected a possible fraud attempt from "255.255.255.255" claiming to be</b></font> <font color="red"><b>MailScanner warning: numerical links are often malicious: 255.255.255.255</a>, TunnelFilter 1</font></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt"><font face="Times New Roman"><span style="mso-spacerun: yes"> </span>3-17: 10:08:29:109:4a8 Setting SPI<span style="mso-spacerun: yes"> </span>1867691868</font></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt"><font face="Times New Roman"><span style="mso-spacerun: yes"> </span>3-17: 10:08:29:109:4a8 constructing ISAKMP Header</font></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt"><font face="Times New Roman"><span style="mso-spacerun: yes"> </span>3-17: 10:08:29:109:4a8 constructing HASH (null)</font></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt"><font face="Times New Roman"><span style="mso-spacerun: yes"> </span>3-17: 10:08:29:109:4a8 constructing SA (IPSEC)</font></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt"><font face="Times New Roman"><span style="mso-spacerun: yes"> </span>3-17: 10:08:29:109:4a8 constructing QM KE</font></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt"><font face="Times New Roman"><span style="mso-spacerun: yes"> </span>3-17: 10:08:29:125:4a8 constructing NONCE (IPSEC)</font></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt"><font face="Times New Roman"><span style="mso-spacerun: yes"> </span>3-17: 10:08:29:125:4a8 constructing ID (proxy)</font></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt"><font face="Times New Roman"><span style="mso-spacerun: yes"> </span>3-17: 10:08:29:125:4a8 constructing ID (proxy)</font></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt"><font face="Times New Roman"><span style="mso-spacerun: yes"> </span>3-17: 10:08:29:125:4a8 constructing HASH (QM)</font></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt"><font face="Times New Roman"><span style="mso-spacerun: yes"> </span>3-17: 10:08:29:125:4a8 </font></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt"><font face="Times New Roman"><span style="mso-spacerun: yes"> </span>3-17: 10:08:29:125:4a8 Sending: SA = 0x00103838 to 192.168.1.55:Type 2.4500</font></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt"><font face="Times New Roman"><span style="mso-spacerun: yes"> </span>3-17: 10:08:29:125:4a8 ISAKMP Header: (V1.0), len = 284</font></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt"><font face="Times New Roman"><span style="mso-spacerun: yes"> </span>3-17: 10:08:29:125:4a8<span style="mso-spacerun: yes"> </span>I-COOKIE 9b3cc29bc2a91b7b</font></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt"><font face="Times New Roman"><span style="mso-spacerun: yes"> </span>3-17: 10:08:29:125:4a8<span style="mso-spacerun: yes"> </span>R-COOKIE fa8d7979591c3d4f</font></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt"><font face="Times New Roman"><span style="mso-spacerun: yes"> </span>3-17: 10:08:29:125:4a8<span style="mso-spacerun: yes"> </span>exchange: Oakley Quick Mode</font></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt"><font face="Times New Roman"><span style="mso-spacerun: yes"> </span>3-17: 10:08:29:125:4a8<span style="mso-spacerun: yes"> </span>flags: 1 ( encrypted )</font></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt"><font face="Times New Roman"><span style="mso-spacerun: yes"> </span>3-17: 10:08:29:125:4a8<span style="mso-spacerun: yes"> </span>next payload: HASH</font></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt"><font face="Times New Roman"><span style="mso-spacerun: yes"> </span>3-17: 10:08:29:125:4a8<span style="mso-spacerun: yes"> </span>message ID: e41e16cd</font></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt"><font face="Times New Roman"><span style="mso-spacerun: yes"> </span>3-17: 10:08:29:125:4a8 Ports S:9411 D:9411</font></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt"><font face="Times New Roman"><span style="mso-spacerun: yes"> </span>3-17: 10:08:29:140:4a8 </font></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt"><font face="Times New Roman"><span style="mso-spacerun: yes"> </span>3-17: 10:08:29:140:4a8 Receive: (get) SA = 0x00103838 from 192.168.1.55.4500</font></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt"><font face="Times New Roman"><span style="mso-spacerun: yes"> </span>3-17: 10:08:29:140:4a8 ISAKMP Header: (V1.0), len = 276</font></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt"><font face="Times New Roman"><span style="mso-spacerun: yes"> </span>3-17: 10:08:29:140:4a8<span style="mso-spacerun: yes"> </span>I-COOKIE 9b3cc29bc2a91b7b</font></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt"><font face="Times New Roman"><span style="mso-spacerun: yes"> </span>3-17: 10:08:29:140:4a8<span style="mso-spacerun: yes"> </span>R-COOKIE fa8d7979591c3d4f</font></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt"><font face="Times New Roman"><span style="mso-spacerun: yes"> </span>3-17: 10:08:29:140:4a8<span style="mso-spacerun: yes"> </span>exchange: Oakley Quick Mode</font></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt"><font face="Times New Roman"><span style="mso-spacerun: yes"> </span>3-17: 10:08:29:140:4a8<span style="mso-spacerun: yes"> </span>flags: 1 ( encrypted )</font></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt"><font face="Times New Roman"><span style="mso-spacerun: yes"> </span>3-17: 10:08:29:140:4a8<span style="mso-spacerun: yes"> </span>next payload: HASH</font></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt"><font face="Times New Roman"><span style="mso-spacerun: yes"> </span>3-17: 10:08:29:140:4a8<span style="mso-spacerun: yes"> </span>message ID: e41e16cd</font></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt"><font face="Times New Roman"><span style="mso-spacerun: yes"> </span>3-17: 10:08:29:140:4a8 processing HASH (QM)</font></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt"><font face="Times New Roman"><span style="mso-spacerun: yes"> </span>3-17: 10:08:29:140:4a8 ClearFragList</font></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt"><font face="Times New Roman"><span style="mso-spacerun: yes"> </span>3-17: 10:08:29:140:4a8 processing payload NONCE</font></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt"><font face="Times New Roman"><span style="mso-spacerun: yes"> </span>3-17: 10:08:29:140:4a8 processing payload KE</font></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt"><font face="Times New Roman"><span style="mso-spacerun: yes"> </span>3-17: 10:08:29:140:4a8 Quick Mode KE processed; Saved KE data</font></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt"><font face="Times New Roman"><span style="mso-spacerun: yes"> </span>3-17: 10:08:29:140:4a8 processing payload ID</font></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt"><font face="Times New Roman"><span style="mso-spacerun: yes"> </span>3-17: 10:08:29:140:4a8 processing payload ID</font></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt"><font face="Times New Roman"><span style="mso-spacerun: yes"> </span>3-17: 10:08:29:140:4a8 processing payload SA</font></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt"><font face="Times New Roman"><span style="mso-spacerun: yes"> </span>3-17: 10:08:29:140:4a8 Negotiated Proxy ID: Src 192.168.1.72.0 Dst 10.10.10.0.0</font></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt"><font face="Times New Roman"><span style="mso-spacerun: yes"> </span>3-17: 10:08:29:140:4a8 Dst id for subnet.<span style="mso-spacerun: yes"> </span>Mask <a href="http://255.255.255.0"></b></font><font color="red"><b>MailScanner has detected a possible fraud attempt from "255.255.255.0" claiming to be</b></font> <font color="red"><b>MailScanner warning: numerical links are often malicious:
255.255.255.0</a></font></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt"><font face="Times New Roman"><span style="mso-spacerun: yes"> </span>3-17: 10:08:29:140:4a8 Checking Proposal 1: Proto= ESP(3), num trans=1 Next=0</font></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt"><font face="Times New Roman"><span style="mso-spacerun: yes"> </span>3-17: 10:08:29:140:4a8 Checking Transform # 1: ID=Triple DES CBC(3)</font></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt"><font face="Times New Roman"><span style="mso-spacerun: yes"> </span>3-17: 10:08:29:140:4a8<span style="mso-spacerun: yes"> </span>tunnel mode is 61443(61443)</font></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt"><font face="Times New Roman"><span style="mso-spacerun: yes"> </span>3-17: 10:08:29:140:4a8<span style="mso-spacerun: yes"> </span>HMAC algorithm is MD5(1)</font></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt"><font face="Times New Roman"><span style="mso-spacerun: yes"> </span>3-17: 10:08:29:140:4a8<span style="mso-spacerun: yes"> </span>group description for PFS is 2</font></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt"><font face="Times New Roman"><span style="mso-spacerun: yes"> </span>3-17: 10:08:29:140:4a8 Phase 2 SA accepted: proposal=1 transform=1</font></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt"><font face="Times New Roman"><span style="mso-spacerun: yes"> </span>3-17: 10:08:29:140:4a8 constructing ISAKMP Header</font></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt"><font face="Times New Roman"><span style="mso-spacerun: yes"> </span>3-17: 10:08:29:140:4a8 constructing HASH (QM)</font></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt"><font face="Times New Roman"><span style="mso-spacerun: yes"> </span>3-17: 10:08:29:140:4a8 Adding QMs: src = 192.168.1.72.0000, dst = 10.10.10.0.0000, proto = 00, context = 00000006, my tunnel =
<a href="http://192.168.1.72"></b></font><font color="red"><b>MailScanner has detected a possible fraud attempt from "192.168.1.72" claiming to be</b></font> <font color="red"><b>MailScanner warning: numerical links are often malicious: 192.168.1.72</a>, peer tunnel = <a href="http://192.168.1.55"></b></font><font color="red"><b>MailScanner has detected a possible fraud attempt from "192.168.1.55" claiming to be</b></font> <font color="red"><b>MailScanner warning: numerical links are often malicious: 192.168.1.55</a>, SrcMask = <a href="http://0.0.0.0"></b></font><font color="red"><b>MailScanner has detected a possible fraud attempt from "0.0.0.0" claiming to be</b></font> <font color="red"><b>MailScanner warning: numerical links are often malicious: 0.0.0.0</a>, DestMask = <a href="http://255.255.255.0"></b></font><font color="red"><b>MailScanner has detected a possible fraud attempt from "255.255.255.0" claiming to be</b></font> <font color="red"><b>MailScanner warning: numerical links are often malicious: 255.255.255.0</a> Lifetime = 3600 LifetimeKBytes 100000 dwFlags 301 Direction 2 EncapType 3
</font></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt"><font face="Times New Roman"><span style="mso-spacerun: yes"> </span>3-17: 10:08:29:140:4a8<span style="mso-spacerun: yes"> </span>Algo[0] Operation: ESP Algo: Triple DES CBC HMAC: MD5
</font></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt"><font face="Times New Roman"><span style="mso-spacerun: yes"> </span>3-17: 10:08:29:140:4a8<span style="mso-spacerun: yes"> </span>Algo[0] MySpi: 1867691868 PeerSpi: 1473643236
</font></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt"><font face="Times New Roman"><span style="mso-spacerun: yes"> </span>3-17: 10:08:29:140:4a8 Encap Ports Src 4500 Dst 4500</font></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt"><font face="Times New Roman"><span style="mso-spacerun: yes"> </span>3-17: 10:08:29:140:4a8 Skipping Outbound SA add</font></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt"><font face="Times New Roman"><span style="mso-spacerun: yes"> </span>3-17: 10:08:29:140:4a8 Adding QMs: src = 192.168.1.72.0000, dst = 10.10.10.0.0000, proto = 00, context = 00000006, my tunnel =
<a href="http://192.168.1.72"></b></font><font color="red"><b>MailScanner has detected a possible fraud attempt from "192.168.1.72" claiming to be</b></font> <font color="red"><b>MailScanner warning: numerical links are often malicious: 192.168.1.72</a>, peer tunnel = <a href="http://192.168.1.55"></b></font><font color="red"><b>MailScanner has detected a possible fraud attempt from "192.168.1.55" claiming to be</b></font> <font color="red"><b>MailScanner warning: numerical links are often malicious: 192.168.1.55</a>, SrcMask = <a href="http://0.0.0.0"></b></font><font color="red"><b>MailScanner has detected a possible fraud attempt from "0.0.0.0" claiming to be</b></font> <font color="red"><b>MailScanner warning: numerical links are often malicious: 0.0.0.0</a>, DestMask = <a href="http://255.255.255.0"></b></font><font color="red"><b>MailScanner has detected a possible fraud attempt from "255.255.255.0" claiming to be</b></font> <font color="red"><b>MailScanner warning: numerical links are often malicious: 255.255.255.0</a> Lifetime = 3600 LifetimeKBytes 100000 dwFlags 301 Direction 3 EncapType 3
</font></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt"><font face="Times New Roman"><span style="mso-spacerun: yes"> </span>3-17: 10:08:29:140:4a8<span style="mso-spacerun: yes"> </span>Algo[0] Operation: ESP Algo: Triple DES CBC HMAC: MD5
</font></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt"><font face="Times New Roman"><span style="mso-spacerun: yes"> </span>3-17: 10:08:29:140:4a8<span style="mso-spacerun: yes"> </span>Algo[0] MySpi: 1867691868 PeerSpi: 1473643236
</font></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt"><font face="Times New Roman"><span style="mso-spacerun: yes"> </span>3-17: 10:08:29:140:4a8 Encap Ports Src 4500 Dst 4500</font></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt"><font face="Times New Roman"><span style="mso-spacerun: yes"> </span>3-17: 10:08:29:140:4a8 Skipping Inbound SA add</font></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt"><font face="Times New Roman"><span style="mso-spacerun: yes"> </span>3-17: 10:08:29:140:4a8 Leaving adjust_peer_list entry 0014FD30 MMCount 0 QMCount 1</font></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt"><font face="Times New Roman"><span style="mso-spacerun: yes"> </span>3-17: 10:08:29:140:4a8 isadb_set_status sa:00103838 centry:0014F288 status 0</font></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt"><font face="Times New Roman"><span style="mso-spacerun: yes"> </span>3-17: 10:08:29:140:4a8 </font></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt"><font face="Times New Roman"><span style="mso-spacerun: yes"> </span>3-17: 10:08:29:140:4a8 Sending: SA = 0x00103838 to 192.168.1.55:Type 4.4500</font></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt"><font face="Times New Roman"><span style="mso-spacerun: yes"> </span>3-17: 10:08:29:140:4a8 ISAKMP Header: (V1.0), len = 52</font></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt"><font face="Times New Roman"><span style="mso-spacerun: yes"> </span>3-17: 10:08:29:140:4a8<span style="mso-spacerun: yes"> </span>I-COOKIE 9b3cc29bc2a91b7b</font></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt"><font face="Times New Roman"><span style="mso-spacerun: yes"> </span>3-17: 10:08:29:140:4a8<span style="mso-spacerun: yes"> </span>R-COOKIE fa8d7979591c3d4f</font></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt"><font face="Times New Roman"><span style="mso-spacerun: yes"> </span>3-17: 10:08:29:140:4a8<span style="mso-spacerun: yes"> </span>exchange: Oakley Quick Mode</font></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt"><font face="Times New Roman"><span style="mso-spacerun: yes"> </span>3-17: 10:08:29:140:4a8<span style="mso-spacerun: yes"> </span>flags: 1 ( encrypted )</font></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt"><font face="Times New Roman"><span style="mso-spacerun: yes"> </span>3-17: 10:08:29:140:4a8<span style="mso-spacerun: yes"> </span>next payload: HASH</font></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt"><font face="Times New Roman"><span style="mso-spacerun: yes"> </span>3-17: 10:08:29:140:4a8<span style="mso-spacerun: yes"> </span>message ID: e41e16cd</font></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt"><font face="Times New Roman"><span style="mso-spacerun: yes"> </span>3-17: 10:08:29:140:4a8 Ports S:9411 D:9411</font></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt"><font face="Times New Roman"><span style="mso-spacerun: yes"> </span>3-17: 10:09:29:156:4a8 CE Dead. sa:00103838 ce:0014F288 status:35ef</font></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt"><font face="Times New Roman"><span style="mso-spacerun: yes"> </span>3-17: 10:10:44:781:f24 isadb_schedule_kill_oldPolicy_sas: 390ea48b-2f34-45bc-84b5e0e9fd360e32 4</font>
</p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt"><font face="Times New Roman"><span style="mso-spacerun: yes"> </span>3-17: 10:10:44:781:f24 isadb_schedule_kill_oldPolicy_sas: d277ddac-d2a3-4c73-8e8962aaaddcaa1a 4</font>
</p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt"><font face="Times New Roman"><span style="mso-spacerun: yes"> </span>3-17: 10:10:44:781:f24 isadb_schedule_kill_oldPolicy_sas: 4a44cc5c-26ce-4b4b-8cbce593d6d19698 3</font>
</p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt"><font face="Times New Roman"><span style="mso-spacerun: yes"> </span>3-17: 10:10:44:781:f24 isadb_schedule_kill_oldPolicy_sas: b3b897d2-4b4e-4573-8fdfc3c090837cb4 3</font>
</p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt"><font face="Times New Roman"><span style="mso-spacerun: yes"> </span>3-17: 10:10:44:781:f24 isadb_schedule_kill_oldPolicy_sas: 5e6807f5-271a-4210-b2fe1e292fabd86b 1</font>
</p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt"><font face="Times New Roman"><span style="mso-spacerun: yes"> </span>3-17: 10:10:44:781:f24 isadb_schedule_kill_oldPolicy_sas: 896ab29d-cdc1-4e6f-aadf474aae37fad3 2</font>
</p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt"><font face="Times New Roman"><span style="mso-spacerun: yes"> </span>3-17: 10:10:44:781:4a8 QM Deleted. Notify from driver: Src <a href="http://192.168.1.72"></b></font><font color="red"><b>MailScanner has detected a possible fraud attempt from "192.168.1.72" claiming to be</b></font> <font color="red"><b>MailScanner warning: numerical links are often malicious: 192.168.1.72</a>
Dest <a href="http://10.10.10.0"></b></font><font color="red"><b>MailScanner has detected a possible fraud attempt from "10.10.10.0" claiming to be</b></font> <font color="red"><b>MailScanner warning: numerical links are often malicious: 10.10.10.0</a> InSPI 1867691868 OutSpi 1473643236<span style="mso-spacerun: yes"> </span>Tunnel 3701a8c0 TunnelFilter 0</font></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt"><font face="Times New Roman"><span style="mso-spacerun: yes"> </span>3-17: 10:10:44:781:4a8 Leaving adjust_peer_list entry 0014FD30 MMCount 0 QMCount 0</font></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt"><font face="Times New Roman"><span style="mso-spacerun: yes"> </span>3-17: 10:10:44:781:4a8 constructing ISAKMP Header</font></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt"><font face="Times New Roman"><span style="mso-spacerun: yes"> </span>3-17: 10:10:44:781:4a8 constructing HASH (null)</font></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt"><font face="Times New Roman"><span style="mso-spacerun: yes"> </span>3-17: 10:10:44:781:4a8 Construct QM Delete Spi 1867691868</font></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt"><font face="Times New Roman"><span style="mso-spacerun: yes"> </span>3-17: 10:10:44:781:4a8 constructing HASH (Notify/Delete)</font></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt"><font face="Times New Roman"><span style="mso-spacerun: yes"> </span>3-17: 10:10:44:781:4a8 Not setting retransmit to downlevel client. SA 00103838 Centry 00000000</font></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt"><font face="Times New Roman"><span style="mso-spacerun: yes"> </span>3-17: 10:10:44:781:4a8 </font></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt"><font face="Times New Roman"><span style="mso-spacerun: yes"> </span>3-17: 10:10:44:781:4a8 Sending: SA = 0x00103838 to 192.168.1.55:Type 1.4500</font></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt"><font face="Times New Roman"><span style="mso-spacerun: yes"> </span>3-17: 10:10:44:781:4a8 ISAKMP Header: (V1.0), len = 68</font></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt"><font face="Times New Roman"><span style="mso-spacerun: yes"> </span>3-17: 10:10:44:781:4a8<span style="mso-spacerun: yes"> </span>I-COOKIE 9b3cc29bc2a91b7b</font></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt"><font face="Times New Roman"><span style="mso-spacerun: yes"> </span>3-17: 10:10:44:781:4a8<span style="mso-spacerun: yes"> </span>R-COOKIE fa8d7979591c3d4f</font></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt"><font face="Times New Roman"><span style="mso-spacerun: yes"> </span>3-17: 10:10:44:781:4a8<span style="mso-spacerun: yes"> </span>exchange: ISAKMP Informational Exchange
</font></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt"><font face="Times New Roman"><span style="mso-spacerun: yes"> </span>3-17: 10:10:44:781:4a8<span style="mso-spacerun: yes"> </span>flags: 1 ( encrypted )</font></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt"><font face="Times New Roman"><span style="mso-spacerun: yes"> </span>3-17: 10:10:44:781:4a8<span style="mso-spacerun: yes"> </span>next payload: HASH</font></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt"><font face="Times New Roman"><span style="mso-spacerun: yes"> </span>3-17: 10:10:44:781:4a8<span style="mso-spacerun: yes"> </span>message ID: b419754f</font></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt"><font face="Times New Roman"><span style="mso-spacerun: yes"> </span>3-17: 10:10:44:781:4a8 Ports S:9411 D:9411</font></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt"><font face="Times New Roman"><span style="mso-spacerun: yes"> </span>3-17: 10:10:44:781:4a8 PrivatePeerAddr 0</font></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt"><font face="Times New Roman"><span style="mso-spacerun: yes"> </span>3-17: 10:10:44:781:4a8 </font></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt"><font face="Times New Roman"><span style="mso-spacerun: yes"> </span>3-17: 10:10:44:781:4a8 Receive: (get) SA = 0x00103838 from 192.168.1.55.4500</font></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt"><font face="Times New Roman"><span style="mso-spacerun: yes"> </span>3-17: 10:10:44:781:4a8 ISAKMP Header: (V1.0), len = 68</font></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt"><font face="Times New Roman"><span style="mso-spacerun: yes"> </span>3-17: 10:10:44:781:4a8<span style="mso-spacerun: yes"> </span>I-COOKIE 9b3cc29bc2a91b7b</font></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt"><font face="Times New Roman"><span style="mso-spacerun: yes"> </span>3-17: 10:10:44:781:4a8<span style="mso-spacerun: yes"> </span>R-COOKIE fa8d7979591c3d4f</font></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt"><font face="Times New Roman"><span style="mso-spacerun: yes"> </span>3-17: 10:10:44:781:4a8<span style="mso-spacerun: yes"> </span>exchange: ISAKMP Informational Exchange
</font></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt"><font face="Times New Roman"><span style="mso-spacerun: yes"> </span>3-17: 10:10:44:781:4a8<span style="mso-spacerun: yes"> </span>flags: 1 ( encrypted )</font></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt"><font face="Times New Roman"><span style="mso-spacerun: yes"> </span>3-17: 10:10:44:781:4a8<span style="mso-spacerun: yes"> </span>next payload: HASH</font></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt"><font face="Times New Roman"><span style="mso-spacerun: yes"> </span>3-17: 10:10:44:781:4a8<span style="mso-spacerun: yes"> </span>message ID: ce23b7ef</font></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt"><font face="Times New Roman"><span style="mso-spacerun: yes"> </span>3-17: 10:10:44:781:4a8 processing HASH (Notify/Delete)</font></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt"><font face="Times New Roman"><span style="mso-spacerun: yes"> </span>3-17: 10:10:44:781:4a8 processing payload DELETE</font></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt"><font face="Times New Roman"><span style="mso-spacerun: yes"> </span>3-17: 10:10:44:781:4a8 Asked to delete phase2 SPI we don't own: 1473643236 proto=3</font></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt"><font face="Times New Roman"><span style="mso-spacerun: yes"> </span>3-17: 10:10:44:796:4a8 entered kill_old_policy_sas 4</font></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt"><font face="Times New Roman"><span style="mso-spacerun: yes"> </span>3-17: 10:10:44:796:4a8 SA Dead. sa:00103838 status:3619</font></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt"><font face="Times New Roman"><span style="mso-spacerun: yes"> </span>3-17: 10:10:44:796:4a8 isadb_set_status sa:00103838 centry:00000000 status 3619</font></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt"><font face="Times New Roman"><span style="mso-spacerun: yes"> </span>3-17: 10:10:44:796:4a8 constructing ISAKMP Header</font></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt"><font face="Times New Roman"><span style="mso-spacerun: yes"> </span>3-17: 10:10:44:796:4a8 constructing HASH (null)</font></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt"><font face="Times New Roman"><span style="mso-spacerun: yes"> </span>3-17: 10:10:44:796:4a8 constructing DELETE. MM 00103838</font></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt"><font face="Times New Roman"><span style="mso-spacerun: yes"> </span>3-17: 10:10:44:796:4a8 constructing HASH (Notify/Delete)</font></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt"><font face="Times New Roman"><span style="mso-spacerun: yes"> </span>3-17: 10:10:44:796:4a8 Not setting retransmit to downlevel client. SA 00103838 Centry 00000000</font></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt"><font face="Times New Roman"><span style="mso-spacerun: yes"> </span>3-17: 10:10:44:796:4a8 </font></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt"><font face="Times New Roman"><span style="mso-spacerun: yes"> </span>3-17: 10:10:44:796:4a8 Sending: SA = 0x00103838 to 192.168.1.55:Type 1.4500</font></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt"><font face="Times New Roman"><span style="mso-spacerun: yes"> </span>3-17: 10:10:44:796:4a8 ISAKMP Header: (V1.0), len = 84</font></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt"><font face="Times New Roman"><span style="mso-spacerun: yes"> </span>3-17: 10:10:44:796:4a8<span style="mso-spacerun: yes"> </span>I-COOKIE 9b3cc29bc2a91b7b</font></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt"><font face="Times New Roman"><span style="mso-spacerun: yes"> </span>3-17: 10:10:44:796:4a8<span style="mso-spacerun: yes"> </span>R-COOKIE fa8d7979591c3d4f</font></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt"><font face="Times New Roman"><span style="mso-spacerun: yes"> </span>3-17: 10:10:44:796:4a8<span style="mso-spacerun: yes"> </span>exchange: ISAKMP Informational Exchange
</font></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt"><font face="Times New Roman"><span style="mso-spacerun: yes"> </span>3-17: 10:10:44:796:4a8<span style="mso-spacerun: yes"> </span>flags: 1 ( encrypted )</font></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt"><font face="Times New Roman"><span style="mso-spacerun: yes"> </span>3-17: 10:10:44:796:4a8<span style="mso-spacerun: yes"> </span>next payload: HASH</font></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt"><font face="Times New Roman"><span style="mso-spacerun: yes"> </span>3-17: 10:10:44:796:4a8<span style="mso-spacerun: yes"> </span>message ID: 6ed30851</font></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt"><font face="Times New Roman"><span style="mso-spacerun: yes"> </span>3-17: 10:10:44:796:4a8 Ports S:9411 D:9411</font></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt"><font face="Times New Roman"><span style="mso-spacerun: yes"> </span>3-17: 10:10:44:796:4a8 entered kill_old_policy_sas 4</font></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt"><font face="Times New Roman"><span style="mso-spacerun: yes"> </span>3-17: 10:10:44:796:4a8 entered kill_old_policy_sas 3</font></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt"><font face="Times New Roman"><span style="mso-spacerun: yes"> </span>3-17: 10:10:44:796:4a8 entered kill_old_policy_sas 3</font></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt"><font face="Times New Roman"><span style="mso-spacerun: yes"> </span>3-17: 10:10:44:796:4a8 entered kill_old_policy_sas 1</font></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt"><font face="Times New Roman"><span style="mso-spacerun: yes"> </span>3-17: 10:10:44:796:4a8 entered kill_old_policy_sas 2</font></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt"><font face="Times New Roman"><span style="mso-spacerun: yes"> </span>3-17: 10:10:44:812:780 </font></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt"><font face="Times New Roman"><span style="mso-spacerun: yes"> </span>3-17: 10:10:44:812:780 Receive: (get) SA = 0x00103838 from 192.168.1.55.4500</font></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt"><font face="Times New Roman"><span style="mso-spacerun: yes"> </span>3-17: 10:10:44:812:780 ISAKMP Header: (V1.0), len = 84</font></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt"><font face="Times New Roman"><span style="mso-spacerun: yes"> </span>3-17: 10:10:44:812:780<span style="mso-spacerun: yes"> </span>I-COOKIE 9b3cc29bc2a91b7b</font></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt"><font face="Times New Roman"><span style="mso-spacerun: yes"> </span>3-17: 10:10:44:812:780<span style="mso-spacerun: yes"> </span>R-COOKIE fa8d7979591c3d4f</font></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt"><font face="Times New Roman"><span style="mso-spacerun: yes"> </span>3-17: 10:10:44:812:780<span style="mso-spacerun: yes"> </span>exchange: ISAKMP Informational Exchange
</font></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt"><font face="Times New Roman"><span style="mso-spacerun: yes"> </span>3-17: 10:10:44:812:780<span style="mso-spacerun: yes"> </span>flags: 1 ( encrypted )</font></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt"><font face="Times New Roman"><span style="mso-spacerun: yes"> </span>3-17: 10:10:44:812:780<span style="mso-spacerun: yes"> </span>next payload: HASH</font></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt"><font face="Times New Roman"><span style="mso-spacerun: yes"> </span>3-17: 10:10:44:812:780<span style="mso-spacerun: yes"> </span>message ID: 27d9c0f2</font></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt"><font face="Times New Roman"><span style="mso-spacerun: yes"> </span>3-17: 10:10:44:812:780 processing HASH (Notify/Delete)</font></p>
<p class="MsoNormal" style="MARGIN: 0in 0in 0pt"><font face="Times New Roman"><span style="mso-spacerun: yes"> </span>3-17: 10:10:44:812:780 processing payload DELETE</font></p><br><br> </div>