No.     Time        Source                Destination           Protocol Info
      5 1.005906    <IPsecCLIENT-IP>         <IPsecSERVER-IP>        ISAKMP   Aggressive

Frame 5 (462 bytes on wire, 462 bytes captured)
    Arrival Time: Feb 21, 2008 22:23:26.970098000
    [Time delta from previous captured frame: 0.528749000 seconds]
    [Time delta from previous displayed frame: 0.528749000 seconds]
    [Time since reference or first frame: 1.005906000 seconds]
    Frame Number: 5
    Frame Length: 462 bytes
    Capture Length: 462 bytes
    [Frame is marked: True]
    [Protocols in frame: eth:ip:udp:isakmp]
    [Coloring Rule Name: UDP]
    [Coloring Rule String: udp]
Ethernet II, Src: <IPsecCLIENT-MAC> (<IPsecCLIENT-MAC>), Dst: <DefaultGateway-MAC> (<DefaultGateway-MAC>)
    Destination: <DefaultGateway-MAC> (<DefaultGateway-MAC>)
        Address: <DefaultGateway-MAC> (<DefaultGateway-MAC>)
        .... ...0 .... .... .... .... = IG bit: Individual address (unicast)
        .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
    Source: <IPsecCLIENT-MAC> (<IPsecCLIENT-MAC>)
        Address: <IPsecCLIENT-MAC> (<IPsecCLIENT-MAC>)
        .... ...0 .... .... .... .... = IG bit: Individual address (unicast)
        .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
    Type: IP (0x0800)
Internet Protocol, Src: <IPsecCLIENT-IP> (<IPsecCLIENT-IP>), Dst: <IPsecSERVER-IP> (<IPsecSERVER-IP>)
    Version: 4
    Header length: 20 bytes
    Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00)
        0000 00.. = Differentiated Services Codepoint: Default (0x00)
        .... ..0. = ECN-Capable Transport (ECT): 0
        .... ...0 = ECN-CE: 0
    Total Length: 448
    Identification: 0x5ffc (24572)
    Flags: 0x00
        0... = Reserved bit: Not set
        .0.. = Don't fragment: Not set
        ..0. = More fragments: Not set
    Fragment offset: 0
    Time to live: 128
    Protocol: UDP (0x11)
    Header checksum: 0x3eaa [correct]
        [Good: True]
        [Bad : False]
    Source: <IPsecCLIENT-IP> (<IPsecCLIENT-IP>)
    Destination: <IPsecSERVER-IP> (<IPsecSERVER-IP>)
User Datagram Protocol, Src Port: windlm (1785), Dst Port: isakmp (500)
    Source port: windlm (1785)
    Destination port: isakmp (500)
    Length: 428
    Checksum: 0x64e6 [correct]
        [Good Checksum: True]
        [Bad Checksum: False]
Internet Security Association and Key Management Protocol
    Initiator cookie: F4B16542588CA2AE
    Responder cookie: 0000000000000000
    Next payload: Security Association (1)
    Version: 1.0
    Exchange type: Aggressive (4)
    Flags: 0x00
        .... ...0 = Not encrypted
        .... ..0. = No commit
        .... .0.. = No authentication
    Message ID: 0x00000000
    Length: 420
    Security Association payload
        Next payload: Vendor ID (13)
        Payload length: 164
        Domain of interpretation: IPSEC (1)
        Situation: IDENTITY (1)
        Proposal payload # 1
            Next payload: NONE (0)
            Payload length: 152
            Proposal number: 1
            Protocol ID: ISAKMP (1)
            SPI Size: 0
            Proposal transforms: 4
            Transform payload # 1
                Next payload: Transform (3)
                Payload length: 36
                Transform number: 1
                Transform ID: KEY_IKE (1)
                Encryption-Algorithm (1): DES-CBC (1)
                Hash-Algorithm (2): MD5 (1)
                Authentication-Method (3): PSK (1)
                Group-Description (4): Alternate 1024-bit MODP group (2)
                Life-Type (11): Seconds (1)
                Life-Duration (12): Duration-Value (864000)
            Transform payload # 2
                Next payload: Transform (3)
                Payload length: 36
                Transform number: 2
                Transform ID: KEY_IKE (1)
                Encryption-Algorithm (1): DES-CBC (1)
                Hash-Algorithm (2): SHA (2)
                Authentication-Method (3): PSK (1)
                Group-Description (4): Alternate 1024-bit MODP group (2)
                Life-Type (11): Seconds (1)
                Life-Duration (12): Duration-Value (864000)
            Transform payload # 3
                Next payload: Transform (3)
                Payload length: 36
                Transform number: 3
                Transform ID: KEY_IKE (1)
                Encryption-Algorithm (1): 3DES-CBC (5)
                Hash-Algorithm (2): MD5 (1)
                Authentication-Method (3): PSK (1)
                Group-Description (4): Alternate 1024-bit MODP group (2)
                Life-Type (11): Seconds (1)
                Life-Duration (12): Duration-Value (864000)
            Transform payload # 4
                Next payload: NONE (0)
                Payload length: 36
                Transform number: 4
                Transform ID: KEY_IKE (1)
                Encryption-Algorithm (1): 3DES-CBC (5)
                Hash-Algorithm (2): SHA (2)
                Authentication-Method (3): PSK (1)
                Group-Description (4): Alternate 1024-bit MODP group (2)
                Life-Type (11): Seconds (1)
                Life-Duration (12): Duration-Value (864000)
    Vendor ID: 4C5643372E312E323A5850
        Next payload: Key Exchange (4)
        Payload length: 15
        Vendor ID: 4C5643372E312E323A5850
    Key Exchange payload
        Next payload: Nonce (10)
        Payload length: 132
        Key Exchange Data (128 bytes / 1024 bits)
    Nonce payload
        Next payload: Identification (5)
        Payload length: 68
        Nonce Data
    Identification payload
        Next payload: NONE (0)
        Payload length: 13
        ID type: 3
        ID type: USER_FQDN (3)
        Protocol ID: Unused
        Port: Unused
        Identification data: !@#$%


No.     Time        Source                Destination           Protocol Info
      6 1.398175    <IPsecSERVER-IP>        <IPsecCLIENT-IP>         ISAKMP   Aggressive

Frame 6 (350 bytes on wire, 350 bytes captured)
    Arrival Time: Feb 21, 2008 22:23:27.362367000
    [Time delta from previous captured frame: 0.392269000 seconds]
    [Time delta from previous displayed frame: 0.392269000 seconds]
    [Time since reference or first frame: 1.398175000 seconds]
    Frame Number: 6
    Frame Length: 350 bytes
    Capture Length: 350 bytes
    [Frame is marked: True]
    [Protocols in frame: eth:ip:udp:isakmp]
    [Coloring Rule Name: UDP]
    [Coloring Rule String: udp]
Ethernet II, Src: <DefaultGateway-MAC> (<DefaultGateway-MAC>), Dst: <IPsecCLIENT-MAC> (<IPsecCLIENT-MAC>)
    Destination: <IPsecCLIENT-MAC> (<IPsecCLIENT-MAC>)
        Address: <IPsecCLIENT-MAC> (<IPsecCLIENT-MAC>)
        .... ...0 .... .... .... .... = IG bit: Individual address (unicast)
        .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
    Source: <DefaultGateway-MAC> (<DefaultGateway-MAC>)
        Address: <DefaultGateway-MAC> (<DefaultGateway-MAC>)
        .... ...0 .... .... .... .... = IG bit: Individual address (unicast)
        .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
    Type: IP (0x0800)
Internet Protocol, Src: <IPsecSERVER-IP> (<IPsecSERVER-IP>), Dst: <IPsecCLIENT-IP> (<IPsecCLIENT-IP>)
    Version: 4
    Header length: 20 bytes
    Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00)
        0000 00.. = Differentiated Services Codepoint: Default (0x00)
        .... ..0. = ECN-Capable Transport (ECT): 0
        .... ...0 = ECN-CE: 0
    Total Length: 336
    Identification: 0x0000 (0)
    Flags: 0x00
        0... = Reserved bit: Not set
        .0.. = Don't fragment: Not set
        ..0. = More fragments: Not set
    Fragment offset: 0
    Time to live: 255
    Protocol: UDP (0x11)
    Header checksum: 0x2016 [correct]
        [Good: True]
        [Bad : False]
    Source: <IPsecSERVER-IP> (<IPsecSERVER-IP>)
    Destination: <IPsecCLIENT-IP> (<IPsecCLIENT-IP>)
User Datagram Protocol, Src Port: isakmp (500), Dst Port: windlm (1785)
    Source port: isakmp (500)
    Destination port: windlm (1785)
    Length: 316
    Checksum: 0x0000 (none)
        Good Checksum: False
        Bad Checksum: False
Internet Security Association and Key Management Protocol
    Initiator cookie: F4B16542588CA2AE
    Responder cookie: 30DB5E384EBAA6E3
    Next payload: Security Association (1)
    Version: 1.0
    Exchange type: Aggressive (4)
    Flags: 0x00
        .... ...0 = Not encrypted
        .... ..0. = No commit
        .... .0.. = No authentication
    Message ID: 0x00000000
    Length: 308
    Security Association payload
        Next payload: Key Exchange (4)
        Payload length: 64
        Domain of interpretation: IPSEC (1)
        Situation: IDENTITY (1)
        Proposal payload # 1
            Next payload: NONE (0)
            Payload length: 52
            Proposal number: 1
            Protocol ID: ISAKMP (1)
            SPI Size: 8
            Proposal transforms: 1
            SPI: 0x30DB5E384EBAA6E3
            Transform payload # 4
                Next payload: NONE (0)
                Payload length: 36
                Transform number: 4
                Transform ID: KEY_IKE (1)
                Encryption-Algorithm (1): 3DES-CBC (5)
                Hash-Algorithm (2): SHA (2)
                Authentication-Method (3): PSK (1)
                Group-Description (4): Alternate 1024-bit MODP group (2)
                Life-Type (11): Seconds (1)
                Life-Duration (12): Duration-Value (864000)
    Key Exchange payload
        Next payload: Nonce (10)
        Payload length: 132
        Key Exchange Data (128 bytes / 1024 bits)
    Nonce payload
        Next payload: Identification (5)
        Payload length: 20
        Nonce Data
    Identification payload
        Next payload: Hash (8)
        Payload length: 12
        ID type: 1
        ID type: IPV4_ADDR (1)
        Protocol ID: Unused
        Port: Unused
        Identification data: <IPsecSERVER-IP>
    Hash payload
        Next payload: Vendor ID (13)
        Payload length: 24
        Hash Data
    Vendor ID: 4C5647392E312E3235353A425249434B3A392E312E323535
        Next payload: NONE (0)
        Payload length: 28
        Vendor ID: 4C5647392E312E3235353A425249434B3A392E312E323535


No.     Time        Source                Destination           Protocol Info
      7 1.401988    <IPsecCLIENT-IP>         <IPsecSERVER-IP>        ISAKMP   Aggressive

Frame 7 (94 bytes on wire, 94 bytes captured)
    Arrival Time: Feb 21, 2008 22:23:27.366180000
    [Time delta from previous captured frame: 0.003813000 seconds]
    [Time delta from previous displayed frame: 0.003813000 seconds]
    [Time since reference or first frame: 1.401988000 seconds]
    Frame Number: 7
    Frame Length: 94 bytes
    Capture Length: 94 bytes
    [Frame is marked: True]
    [Protocols in frame: eth:ip:udp:isakmp]
    [Coloring Rule Name: UDP]
    [Coloring Rule String: udp]
Ethernet II, Src: <IPsecCLIENT-MAC> (<IPsecCLIENT-MAC>), Dst: <DefaultGateway-MAC> (<DefaultGateway-MAC>)
    Destination: <DefaultGateway-MAC> (<DefaultGateway-MAC>)
        Address: <DefaultGateway-MAC> (<DefaultGateway-MAC>)
        .... ...0 .... .... .... .... = IG bit: Individual address (unicast)
        .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
    Source: <IPsecCLIENT-MAC> (<IPsecCLIENT-MAC>)
        Address: <IPsecCLIENT-MAC> (<IPsecCLIENT-MAC>)
        .... ...0 .... .... .... .... = IG bit: Individual address (unicast)
        .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
    Type: IP (0x0800)
Internet Protocol, Src: <IPsecCLIENT-IP> (<IPsecCLIENT-IP>), Dst: <IPsecSERVER-IP> (<IPsecSERVER-IP>)
    Version: 4
    Header length: 20 bytes
    Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00)
        0000 00.. = Differentiated Services Codepoint: Default (0x00)
        .... ..0. = ECN-Capable Transport (ECT): 0
        .... ...0 = ECN-CE: 0
    Total Length: 80
    Identification: 0x6009 (24585)
    Flags: 0x00
        0... = Reserved bit: Not set
        .0.. = Don't fragment: Not set
        ..0. = More fragments: Not set
    Fragment offset: 0
    Time to live: 128
    Protocol: UDP (0x11)
    Header checksum: 0x400d [correct]
        [Good: True]
        [Bad : False]
    Source: <IPsecCLIENT-IP> (<IPsecCLIENT-IP>)
    Destination: <IPsecSERVER-IP> (<IPsecSERVER-IP>)
User Datagram Protocol, Src Port: windlm (1785), Dst Port: isakmp (500)
    Source port: windlm (1785)
    Destination port: isakmp (500)
    Length: 60
    Checksum: 0xc535 [correct]
        [Good Checksum: True]
        [Bad Checksum: False]
Internet Security Association and Key Management Protocol
    Initiator cookie: F4B16542588CA2AE
    Responder cookie: 30DB5E384EBAA6E3
    Next payload: Hash (8)
    Version: 1.0
    Exchange type: Aggressive (4)
    Flags: 0x00
        .... ...0 = Not encrypted
        .... ..0. = No commit
        .... .0.. = No authentication
    Message ID: 0x00000000
    Length: 52
    Hash payload
        Next payload: NONE (0)
        Payload length: 24
        Hash Data


No.     Time        Source                Destination           Protocol Info
      8 1.705362    <IPsecSERVER-IP>        <IPsecCLIENT-IP>         ISAKMP   Informational

Frame 8 (110 bytes on wire, 110 bytes captured)
    Arrival Time: Feb 21, 2008 22:23:27.669554000
    [Time delta from previous captured frame: 0.303374000 seconds]
    [Time delta from previous displayed frame: 0.303374000 seconds]
    [Time since reference or first frame: 1.705362000 seconds]
    Frame Number: 8
    Frame Length: 110 bytes
    Capture Length: 110 bytes
    [Frame is marked: True]
    [Protocols in frame: eth:ip:udp:isakmp]
    [Coloring Rule Name: UDP]
    [Coloring Rule String: udp]
Ethernet II, Src: <DefaultGateway-MAC> (<DefaultGateway-MAC>), Dst: <IPsecCLIENT-MAC> (<IPsecCLIENT-MAC>)
    Destination: <IPsecCLIENT-MAC> (<IPsecCLIENT-MAC>)
        Address: <IPsecCLIENT-MAC> (<IPsecCLIENT-MAC>)
        .... ...0 .... .... .... .... = IG bit: Individual address (unicast)
        .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
    Source: <DefaultGateway-MAC> (<DefaultGateway-MAC>)
        Address: <DefaultGateway-MAC> (<DefaultGateway-MAC>)
        .... ...0 .... .... .... .... = IG bit: Individual address (unicast)
        .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
    Type: IP (0x0800)
Internet Protocol, Src: <IPsecSERVER-IP> (<IPsecSERVER-IP>), Dst: <IPsecCLIENT-IP> (<IPsecCLIENT-IP>)
    Version: 4
    Header length: 20 bytes
    Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00)
        0000 00.. = Differentiated Services Codepoint: Default (0x00)
        .... ..0. = ECN-Capable Transport (ECT): 0
        .... ...0 = ECN-CE: 0
    Total Length: 96
    Identification: 0x0000 (0)
    Flags: 0x00
        0... = Reserved bit: Not set
        .0.. = Don't fragment: Not set
        ..0. = More fragments: Not set
    Fragment offset: 0
    Time to live: 255
    Protocol: UDP (0x11)
    Header checksum: 0x2106 [correct]
        [Good: True]
        [Bad : False]
    Source: <IPsecSERVER-IP> (<IPsecSERVER-IP>)
    Destination: <IPsecCLIENT-IP> (<IPsecCLIENT-IP>)
User Datagram Protocol, Src Port: isakmp (500), Dst Port: windlm (1785)
    Source port: isakmp (500)
    Destination port: windlm (1785)
    Length: 76
    Checksum: 0x0000 (none)
        Good Checksum: False
        Bad Checksum: False
Internet Security Association and Key Management Protocol
    Initiator cookie: F4B16542588CA2AE
    Responder cookie: 30DB5E384EBAA6E3
    Next payload: Hash (8)
    Version: 1.0
    Exchange type: Informational (5)
    Flags: 0x01
        .... ...1 = Encrypted
        .... ..0. = No commit
        .... .0.. = No authentication
    Message ID: 0x4cffc6ff
    Length: 68
    Encrypted payload (40 bytes)


No.     Time        Source                Destination           Protocol Info
      9 1.705646    <IPsecCLIENT-IP>         <IPsecSERVER-IP>        ISAKMP   Informational

Frame 9 (166 bytes on wire, 166 bytes captured)
    Arrival Time: Feb 21, 2008 22:23:27.669838000
    [Time delta from previous captured frame: 0.000284000 seconds]
    [Time delta from previous displayed frame: 0.000284000 seconds]
    [Time since reference or first frame: 1.705646000 seconds]
    Frame Number: 9
    Frame Length: 166 bytes
    Capture Length: 166 bytes
    [Frame is marked: True]
    [Protocols in frame: eth:ip:udp:isakmp]
    [Coloring Rule Name: UDP]
    [Coloring Rule String: udp]
Ethernet II, Src: <IPsecCLIENT-MAC> (<IPsecCLIENT-MAC>), Dst: <DefaultGateway-MAC> (<DefaultGateway-MAC>)
    Destination: <DefaultGateway-MAC> (<DefaultGateway-MAC>)
        Address: <DefaultGateway-MAC> (<DefaultGateway-MAC>)
        .... ...0 .... .... .... .... = IG bit: Individual address (unicast)
        .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
    Source: <IPsecCLIENT-MAC> (<IPsecCLIENT-MAC>)
        Address: <IPsecCLIENT-MAC> (<IPsecCLIENT-MAC>)
        .... ...0 .... .... .... .... = IG bit: Individual address (unicast)
        .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
    Type: IP (0x0800)
Internet Protocol, Src: <IPsecCLIENT-IP> (<IPsecCLIENT-IP>), Dst: <IPsecSERVER-IP> (<IPsecSERVER-IP>)
    Version: 4
    Header length: 20 bytes
    Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00)
        0000 00.. = Differentiated Services Codepoint: Default (0x00)
        .... ..0. = ECN-Capable Transport (ECT): 0
        .... ...0 = ECN-CE: 0
    Total Length: 152
    Identification: 0x6018 (24600)
    Flags: 0x00
        0... = Reserved bit: Not set
        .0.. = Don't fragment: Not set
        ..0. = More fragments: Not set
    Fragment offset: 0
    Time to live: 128
    Protocol: UDP (0x11)
    Header checksum: 0x3fb6 [correct]
        [Good: True]
        [Bad : False]
    Source: <IPsecCLIENT-IP> (<IPsecCLIENT-IP>)
    Destination: <IPsecSERVER-IP> (<IPsecSERVER-IP>)
User Datagram Protocol, Src Port: windlm (1785), Dst Port: isakmp (500)
    Source port: windlm (1785)
    Destination port: isakmp (500)
    Length: 132
    Checksum: 0xd2a6 [correct]
        [Good Checksum: True]
        [Bad Checksum: False]
Internet Security Association and Key Management Protocol
    Initiator cookie: F4B16542588CA2AE
    Responder cookie: 30DB5E384EBAA6E3
    Next payload: Hash (8)
    Version: 1.0
    Exchange type: Informational (5)
    Flags: 0x01
        .... ...1 = Encrypted
        .... ..0. = No commit
        .... .0.. = No authentication
    Message ID: 0x1b19e6b2
    Length: 124
    Encrypted payload (96 bytes)


No.     Time        Source                Destination           Protocol Info
     10 4.368053    <IPsecSERVER-IP>        <IPsecCLIENT-IP>         ISAKMP   Informational

Frame 10 (1174 bytes on wire, 1174 bytes captured)
    Arrival Time: Feb 21, 2008 22:23:30.332245000
    [Time delta from previous captured frame: 2.662407000 seconds]
    [Time delta from previous displayed frame: 2.662407000 seconds]
    [Time since reference or first frame: 4.368053000 seconds]
    Frame Number: 10
    Frame Length: 1174 bytes
    Capture Length: 1174 bytes
    [Frame is marked: True]
    [Protocols in frame: eth:ip:udp:isakmp]
    [Coloring Rule Name: UDP]
    [Coloring Rule String: udp]
Ethernet II, Src: <DefaultGateway-MAC> (<DefaultGateway-MAC>), Dst: <IPsecCLIENT-MAC> (<IPsecCLIENT-MAC>)
    Destination: <IPsecCLIENT-MAC> (<IPsecCLIENT-MAC>)
        Address: <IPsecCLIENT-MAC> (<IPsecCLIENT-MAC>)
        .... ...0 .... .... .... .... = IG bit: Individual address (unicast)
        .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
    Source: <DefaultGateway-MAC> (<DefaultGateway-MAC>)
        Address: <DefaultGateway-MAC> (<DefaultGateway-MAC>)
        .... ...0 .... .... .... .... = IG bit: Individual address (unicast)
        .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
    Type: IP (0x0800)
Internet Protocol, Src: <IPsecSERVER-IP> (<IPsecSERVER-IP>), Dst: <IPsecCLIENT-IP> (<IPsecCLIENT-IP>)
    Version: 4
    Header length: 20 bytes
    Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00)
        0000 00.. = Differentiated Services Codepoint: Default (0x00)
        .... ..0. = ECN-Capable Transport (ECT): 0
        .... ...0 = ECN-CE: 0
    Total Length: 1160
    Identification: 0x0000 (0)
    Flags: 0x00
        0... = Reserved bit: Not set
        .0.. = Don't fragment: Not set
        ..0. = More fragments: Not set
    Fragment offset: 0
    Time to live: 255
    Protocol: UDP (0x11)
    Header checksum: 0x1cde [correct]
        [Good: True]
        [Bad : False]
    Source: <IPsecSERVER-IP> (<IPsecSERVER-IP>)
    Destination: <IPsecCLIENT-IP> (<IPsecCLIENT-IP>)
User Datagram Protocol, Src Port: isakmp (500), Dst Port: windlm (1785)
    Source port: isakmp (500)
    Destination port: windlm (1785)
    Length: 1140
    Checksum: 0x0000 (none)
        Good Checksum: False
        Bad Checksum: False
Internet Security Association and Key Management Protocol
    Initiator cookie: F4B16542588CA2AE
    Responder cookie: 30DB5E384EBAA6E3
    Next payload: Hash (8)
    Version: 1.0
    Exchange type: Informational (5)
    Flags: 0x01
        .... ...1 = Encrypted
        .... ..0. = No commit
        .... .0.. = No authentication
    Message ID: 0xf243574b
    Length: 1132
    Encrypted payload (1104 bytes)


No.     Time        Source                Destination           Protocol Info
     11 4.381291    <IPsecCLIENT-IP>         <IPsecSERVER-IP>        IP       Fragmented IP protocol (proto=UDP 0x11, off=0) [Reassembled in#12]

Frame 11 (1402 bytes on wire, 1402 bytes captured)
    Arrival Time: Feb 21, 2008 22:23:30.345483000
    [Time delta from previous captured frame: 0.013238000 seconds]
    [Time delta from previous displayed frame: 0.013238000 seconds]
    [Time since reference or first frame: 4.381291000 seconds]
    Frame Number: 11
    Frame Length: 1402 bytes
    Capture Length: 1402 bytes
    [Frame is marked: True]
    [Protocols in frame: eth:ip:data]
Ethernet II, Src: <IPsecCLIENT-MAC> (<IPsecCLIENT-MAC>), Dst: <DefaultGateway-MAC> (<DefaultGateway-MAC>)
    Destination: <DefaultGateway-MAC> (<DefaultGateway-MAC>)
        Address: <DefaultGateway-MAC> (<DefaultGateway-MAC>)
        .... ...0 .... .... .... .... = IG bit: Individual address (unicast)
        .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
    Source: <IPsecCLIENT-MAC> (<IPsecCLIENT-MAC>)
        Address: <IPsecCLIENT-MAC> (<IPsecCLIENT-MAC>)
        .... ...0 .... .... .... .... = IG bit: Individual address (unicast)
        .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
    Type: IP (0x0800)
Internet Protocol, Src: <IPsecCLIENT-IP> (<IPsecCLIENT-IP>), Dst: <IPsecSERVER-IP> (<IPsecSERVER-IP>)
    Version: 4
    Header length: 20 bytes
    Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00)
        0000 00.. = Differentiated Services Codepoint: Default (0x00)
        .... ..0. = ECN-Capable Transport (ECT): 0
        .... ...0 = ECN-CE: 0
    Total Length: 1388
    Identification: 0x609d (24733)
    Flags: 0x02 (More Fragments)
        0... = Reserved bit: Not set
        .0.. = Don't fragment: Not set
        ..1. = More fragments: Set
    Fragment offset: 0
    Time to live: 128
    Protocol: UDP (0x11)
    Header checksum: 0x1a5d [correct]
        [Good: True]
        [Bad : False]
    Source: <IPsecCLIENT-IP> (<IPsecCLIENT-IP>)
    Destination: <IPsecSERVER-IP> (<IPsecSERVER-IP>)
    Reassembled IP in frame: 12
Data (1368 bytes)
    Data: <REMOVED DATA WAS HERE>...


No.     Time        Source                Destination           Protocol Info
     12 4.381399    <IPsecCLIENT-IP>         <IPsecSERVER-IP>        ISAKMP   Quick Mode

Frame 12 (334 bytes on wire, 334 bytes captured)
    Arrival Time: Feb 21, 2008 22:23:30.345591000
    [Time delta from previous captured frame: 0.000108000 seconds]
    [Time delta from previous displayed frame: 0.000108000 seconds]
    [Time since reference or first frame: 4.381399000 seconds]
    Frame Number: 12
    Frame Length: 334 bytes
    Capture Length: 334 bytes
    [Frame is marked: True]
    [Protocols in frame: eth:ip:udp:isakmp]
    [Coloring Rule Name: UDP]
    [Coloring Rule String: udp]
Ethernet II, Src: <IPsecCLIENT-MAC> (<IPsecCLIENT-MAC>), Dst: <DefaultGateway-MAC> (<DefaultGateway-MAC>)
    Destination: <DefaultGateway-MAC> (<DefaultGateway-MAC>)
        Address: <DefaultGateway-MAC> (<DefaultGateway-MAC>)
        .... ...0 .... .... .... .... = IG bit: Individual address (unicast)
        .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
    Source: <IPsecCLIENT-MAC> (<IPsecCLIENT-MAC>)
        Address: <IPsecCLIENT-MAC> (<IPsecCLIENT-MAC>)
        .... ...0 .... .... .... .... = IG bit: Individual address (unicast)
        .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
    Type: IP (0x0800)
Internet Protocol, Src: <IPsecCLIENT-IP> (<IPsecCLIENT-IP>), Dst: <IPsecSERVER-IP> (<IPsecSERVER-IP>)
    Version: 4
    Header length: 20 bytes
    Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00)
        0000 00.. = Differentiated Services Codepoint: Default (0x00)
        .... ..0. = ECN-Capable Transport (ECT): 0
        .... ...0 = ECN-CE: 0
    Total Length: 320
    Identification: 0x609d (24733)
    Flags: 0x00
        0... = Reserved bit: Not set
        .0.. = Don't fragment: Not set
        ..0. = More fragments: Not set
    Fragment offset: 1368
    Time to live: 128
    Protocol: UDP (0x11)
    Header checksum: 0x3dde [correct]
        [Good: True]
        [Bad : False]
    Source: <IPsecCLIENT-IP> (<IPsecCLIENT-IP>)
    Destination: <IPsecSERVER-IP> (<IPsecSERVER-IP>)
    [IP Fragments (1668 bytes): #11(1368), #12(300)]
        [Frame: 11, payload: 0-1367 (1368 bytes)]
        [Frame: 12, payload: 1368-1667 (300 bytes)]
User Datagram Protocol, Src Port: windlm (1785), Dst Port: isakmp (500)
    Source port: windlm (1785)
    Destination port: isakmp (500)
    Length: 1668
    Checksum: 0x0dfa [correct]
        [Good Checksum: True]
        [Bad Checksum: False]
Internet Security Association and Key Management Protocol
    Initiator cookie: F4B16542588CA2AE
    Responder cookie: 30DB5E384EBAA6E3
    Next payload: Hash (8)
    Version: 1.0
    Exchange type: Quick Mode (32)
    Flags: 0x01
        .... ...1 = Encrypted
        .... ..0. = No commit
        .... .0.. = No authentication
    Message ID: 0xee0e5d7c
    Length: 1660
    Encrypted payload (1632 bytes)


No.     Time        Source                Destination           Protocol Info
     13 4.778303    <IPsecSERVER-IP>        <IPsecCLIENT-IP>         ISAKMP   Quick Mode

Frame 13 (278 bytes on wire, 278 bytes captured)
    Arrival Time: Feb 21, 2008 22:23:30.742495000
    [Time delta from previous captured frame: 0.396904000 seconds]
    [Time delta from previous displayed frame: 0.396904000 seconds]
    [Time since reference or first frame: 4.778303000 seconds]
    Frame Number: 13
    Frame Length: 278 bytes
    Capture Length: 278 bytes
    [Frame is marked: True]
    [Protocols in frame: eth:ip:udp:isakmp]
    [Coloring Rule Name: UDP]
    [Coloring Rule String: udp]
Ethernet II, Src: <DefaultGateway-MAC> (<DefaultGateway-MAC>), Dst: <IPsecCLIENT-MAC> (<IPsecCLIENT-MAC>)
    Destination: <IPsecCLIENT-MAC> (<IPsecCLIENT-MAC>)
        Address: <IPsecCLIENT-MAC> (<IPsecCLIENT-MAC>)
        .... ...0 .... .... .... .... = IG bit: Individual address (unicast)
        .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
    Source: <DefaultGateway-MAC> (<DefaultGateway-MAC>)
        Address: <DefaultGateway-MAC> (<DefaultGateway-MAC>)
        .... ...0 .... .... .... .... = IG bit: Individual address (unicast)
        .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
    Type: IP (0x0800)
Internet Protocol, Src: <IPsecSERVER-IP> (<IPsecSERVER-IP>), Dst: <IPsecCLIENT-IP> (<IPsecCLIENT-IP>)
    Version: 4
    Header length: 20 bytes
    Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00)
        0000 00.. = Differentiated Services Codepoint: Default (0x00)
        .... ..0. = ECN-Capable Transport (ECT): 0
        .... ...0 = ECN-CE: 0
    Total Length: 264
    Identification: 0x0000 (0)
    Flags: 0x00
        0... = Reserved bit: Not set
        .0.. = Don't fragment: Not set
        ..0. = More fragments: Not set
    Fragment offset: 0
    Time to live: 255
    Protocol: UDP (0x11)
    Header checksum: 0x205e [correct]
        [Good: True]
        [Bad : False]
    Source: <IPsecSERVER-IP> (<IPsecSERVER-IP>)
    Destination: <IPsecCLIENT-IP> (<IPsecCLIENT-IP>)
User Datagram Protocol, Src Port: isakmp (500), Dst Port: windlm (1785)
    Source port: isakmp (500)
    Destination port: windlm (1785)
    Length: 244
    Checksum: 0x0000 (none)
        Good Checksum: False
        Bad Checksum: False
Internet Security Association and Key Management Protocol
    Initiator cookie: F4B16542588CA2AE
    Responder cookie: 30DB5E384EBAA6E3
    Next payload: Hash (8)
    Version: 1.0
    Exchange type: Quick Mode (32)
    Flags: 0x01
        .... ...1 = Encrypted
        .... ..0. = No commit
        .... .0.. = No authentication
    Message ID: 0xee0e5d7c
    Length: 236
    Encrypted payload (208 bytes)


No.     Time        Source                Destination           Protocol Info
     14 4.778965    <IPsecCLIENT-IP>         <IPsecSERVER-IP>        ISAKMP   Quick Mode

Frame 14 (94 bytes on wire, 94 bytes captured)
    Arrival Time: Feb 21, 2008 22:23:30.743157000
    [Time delta from previous captured frame: 0.000662000 seconds]
    [Time delta from previous displayed frame: 0.000662000 seconds]
    [Time since reference or first frame: 4.778965000 seconds]
    Frame Number: 14
    Frame Length: 94 bytes
    Capture Length: 94 bytes
    [Frame is marked: True]
    [Protocols in frame: eth:ip:udp:isakmp]
    [Coloring Rule Name: UDP]
    [Coloring Rule String: udp]
Ethernet II, Src: <IPsecCLIENT-MAC> (<IPsecCLIENT-MAC>), Dst: <DefaultGateway-MAC> (<DefaultGateway-MAC>)
    Destination: <DefaultGateway-MAC> (<DefaultGateway-MAC>)
        Address: <DefaultGateway-MAC> (<DefaultGateway-MAC>)
        .... ...0 .... .... .... .... = IG bit: Individual address (unicast)
        .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
    Source: <IPsecCLIENT-MAC> (<IPsecCLIENT-MAC>)
        Address: <IPsecCLIENT-MAC> (<IPsecCLIENT-MAC>)
        .... ...0 .... .... .... .... = IG bit: Individual address (unicast)
        .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
    Type: IP (0x0800)
Internet Protocol, Src: <IPsecCLIENT-IP> (<IPsecCLIENT-IP>), Dst: <IPsecSERVER-IP> (<IPsecSERVER-IP>)
    Version: 4
    Header length: 20 bytes
    Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00)
        0000 00.. = Differentiated Services Codepoint: Default (0x00)
        .... ..0. = ECN-Capable Transport (ECT): 0
        .... ...0 = ECN-CE: 0
    Total Length: 80
    Identification: 0x60ac (24748)
    Flags: 0x00
        0... = Reserved bit: Not set
        .0.. = Don't fragment: Not set
        ..0. = More fragments: Not set
    Fragment offset: 0
    Time to live: 128
    Protocol: UDP (0x11)
    Header checksum: 0x3f6a [correct]
        [Good: True]
        [Bad : False]
    Source: <IPsecCLIENT-IP> (<IPsecCLIENT-IP>)
    Destination: <IPsecSERVER-IP> (<IPsecSERVER-IP>)
User Datagram Protocol, Src Port: windlm (1785), Dst Port: isakmp (500)
    Source port: windlm (1785)
    Destination port: isakmp (500)
    Length: 60
    Checksum: 0x4155 [correct]
        [Good Checksum: True]
        [Bad Checksum: False]
Internet Security Association and Key Management Protocol
    Initiator cookie: F4B16542588CA2AE
    Responder cookie: 30DB5E384EBAA6E3
    Next payload: Hash (8)
    Version: 1.0
    Exchange type: Quick Mode (32)
    Flags: 0x01
        .... ...1 = Encrypted
        .... ..0. = No commit
        .... .0.. = No authentication
    Message ID: 0xee0e5d7c
    Length: 52
    Encrypted payload (24 bytes)


No.     Time        Source                Destination           Protocol Info
     15 5.086442    <IPsecSERVER-IP>        <IPsecCLIENT-IP>         ISAKMP   Informational

Frame 15 (126 bytes on wire, 126 bytes captured)
    Arrival Time: Feb 21, 2008 22:23:31.050634000
    [Time delta from previous captured frame: 0.307477000 seconds]
    [Time delta from previous displayed frame: 0.307477000 seconds]
    [Time since reference or first frame: 5.086442000 seconds]
    Frame Number: 15
    Frame Length: 126 bytes
    Capture Length: 126 bytes
    [Frame is marked: True]
    [Protocols in frame: eth:ip:udp:isakmp]
    [Coloring Rule Name: UDP]
    [Coloring Rule String: udp]
Ethernet II, Src: <DefaultGateway-MAC> (<DefaultGateway-MAC>), Dst: <IPsecCLIENT-MAC> (<IPsecCLIENT-MAC>)
    Destination: <IPsecCLIENT-MAC> (<IPsecCLIENT-MAC>)
        Address: <IPsecCLIENT-MAC> (<IPsecCLIENT-MAC>)
        .... ...0 .... .... .... .... = IG bit: Individual address (unicast)
        .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
    Source: <DefaultGateway-MAC> (<DefaultGateway-MAC>)
        Address: <DefaultGateway-MAC> (<DefaultGateway-MAC>)
        .... ...0 .... .... .... .... = IG bit: Individual address (unicast)
        .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
    Type: IP (0x0800)
Internet Protocol, Src: <IPsecSERVER-IP> (<IPsecSERVER-IP>), Dst: <IPsecCLIENT-IP> (<IPsecCLIENT-IP>)
    Version: 4
    Header length: 20 bytes
    Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00)
        0000 00.. = Differentiated Services Codepoint: Default (0x00)
        .... ..0. = ECN-Capable Transport (ECT): 0
        .... ...0 = ECN-CE: 0
    Total Length: 112
    Identification: 0x0000 (0)
    Flags: 0x00
        0... = Reserved bit: Not set
        .0.. = Don't fragment: Not set
        ..0. = More fragments: Not set
    Fragment offset: 0
    Time to live: 255
    Protocol: UDP (0x11)
    Header checksum: 0x20f6 [correct]
        [Good: True]
        [Bad : False]
    Source: <IPsecSERVER-IP> (<IPsecSERVER-IP>)
    Destination: <IPsecCLIENT-IP> (<IPsecCLIENT-IP>)
User Datagram Protocol, Src Port: isakmp (500), Dst Port: windlm (1785)
    Source port: isakmp (500)
    Destination port: windlm (1785)
    Length: 92
    Checksum: 0x0000 (none)
        Good Checksum: False
        Bad Checksum: False
Internet Security Association and Key Management Protocol
    Initiator cookie: F4B16542588CA2AE
    Responder cookie: 30DB5E384EBAA6E3
    Next payload: Hash (8)
    Version: 1.0
    Exchange type: Informational (5)
    Flags: 0x01
        .... ...1 = Encrypted
        .... ..0. = No commit
        .... .0.. = No authentication
    Message ID: 0xf4fa30f2
    Length: 84
    Encrypted payload (56 bytes)