No. Time Source Destination Protocol Info 1 0.000000 ISAKMP Aggressive Frame 1 (426 bytes on wire, 426 bytes captured) Arrival Time: Feb 25, 2008 21:46:47.116155000 [Time delta from previous captured frame: 0.000000000 seconds] [Time delta from previous displayed frame: 0.000000000 seconds] [Time since reference or first frame: 0.000000000 seconds] Frame Number: 1 Frame Length: 426 bytes Capture Length: 426 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] [Coloring Rule Name: UDP] [Coloring Rule String: udp] Ethernet II, Src: (), Dst: () Destination: () Address: () .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: () Address: () .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: (), Dst: () Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 412 Identification: 0x0000 (0) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0x9eca [correct] [Good: True] [Bad : False] Source: () Destination: () User Datagram Protocol, Src Port: isakmp (500), Dst Port: isakmp (500) Source port: isakmp (500) Destination port: isakmp (500) Length: 392 Checksum: 0xa91e [correct] [Good Checksum: True] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: 37FFFD44A813ECF4 Responder cookie: 0000000000000000 Next payload: Security Association (1) Version: 1.0 Exchange type: Aggressive (4) Flags: 0x00 .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 384 Security Association payload Next payload: Key Exchange (4) Payload length: 56 Domain of interpretation: IPSEC (1) Situation: IDENTITY (1) Proposal payload # 0 Next payload: NONE (0) Payload length: 44 Proposal number: 0 Protocol ID: ISAKMP (1) SPI Size: 0 Proposal transforms: 1 Transform payload # 0 Next payload: NONE (0) Payload length: 36 Transform number: 0 Transform ID: KEY_IKE (1) Life-Type (11): Seconds (1) Life-Duration (12): Duration-Value (864000) Encryption-Algorithm (1): 3DES-CBC (5) Hash-Algorithm (2): SHA (2) Authentication-Method (3): XAUTHInitPreShared (65001) Group-Description (4): Alternate 1024-bit MODP group (2) Key Exchange payload Next payload: Nonce (10) Payload length: 132 Key Exchange Data (128 bytes / 1024 bits) Nonce payload Next payload: Identification (5) Payload length: 20 Nonce Data Identification payload Next payload: Vendor ID (13) Payload length: 13 ID type: 3 ID type: USER_FQDN (3) Protocol ID: Unused Port: Unused Identification data: !@#$% Vendor ID: RFC 3706 Detecting Dead IKE Peers (DPD) Next payload: Vendor ID (13) Payload length: 20 Vendor ID: RFC 3706 Detecting Dead IKE Peers (DPD) Vendor ID: RFC 3947 Negotiation of NAT-Traversal in the IKE Next payload: Vendor ID (13) Payload length: 20 Vendor ID: RFC 3947 Negotiation of NAT-Traversal in the IKE Vendor ID: draft-ietf-ipsec-nat-t-ike-03 Next payload: Vendor ID (13) Payload length: 20 Vendor ID: draft-ietf-ipsec-nat-t-ike-03 Vendor ID: draft-ietf-ipsec-nat-t-ike-02 Next payload: Vendor ID (13) Payload length: 20 Vendor ID: draft-ietf-ipsec-nat-t-ike-02 Vendor ID: draft-ietf-ipsec-nat-t-ike-02\n Next payload: Vendor ID (13) Payload length: 20 Vendor ID: draft-ietf-ipsec-nat-t-ike-02\n Vendor ID: draft-ietf-ipsec-nat-t-ike-00 Next payload: Vendor ID (13) Payload length: 20 Vendor ID: draft-ietf-ipsec-nat-t-ike-00 Vendor ID: draft-beaulieu-ike-xauth-02.txt Next payload: NONE (0) Payload length: 12 Vendor ID: draft-beaulieu-ike-xauth-02.txt Extra data: 000000 No. Time Source Destination Protocol Info 2 0.273265 ISAKMP Aggressive Frame 2 (350 bytes on wire, 350 bytes captured) Arrival Time: Feb 25, 2008 21:46:47.389420000 [Time delta from previous captured frame: 0.273265000 seconds] [Time delta from previous displayed frame: 0.273265000 seconds] [Time since reference or first frame: 0.273265000 seconds] Frame Number: 2 Frame Length: 350 bytes Capture Length: 350 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] [Coloring Rule Name: UDP] [Coloring Rule String: udp] Ethernet II, Src: (), Dst: () Destination: () Address: () .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: () Address: () .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: (), Dst: () Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 336 Identification: 0x0000 (0) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 246 Protocol: UDP (0x11) Header checksum: 0x2916 [correct] [Good: True] [Bad : False] Source: () Destination: () User Datagram Protocol, Src Port: isakmp (500), Dst Port: isakmp (500) Source port: isakmp (500) Destination port: isakmp (500) Length: 316 Checksum: 0xa7d2 [correct] [Good Checksum: True] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: 37FFFD44A813ECF4 Responder cookie: 1140785502B1B6C2 Next payload: Security Association (1) Version: 1.0 Exchange type: Aggressive (4) Flags: 0x00 .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 308 Security Association payload Next payload: Key Exchange (4) Payload length: 64 Domain of interpretation: IPSEC (1) Situation: IDENTITY (1) Proposal payload # 0 Next payload: NONE (0) Payload length: 52 Proposal number: 0 Protocol ID: ISAKMP (1) SPI Size: 8 Proposal transforms: 1 SPI: 0x1140785502B1B6C2 Transform payload # 0 Next payload: NONE (0) Payload length: 36 Transform number: 0 Transform ID: KEY_IKE (1) Life-Type (11): Seconds (1) Life-Duration (12): Duration-Value (864000) Encryption-Algorithm (1): 3DES-CBC (5) Hash-Algorithm (2): SHA (2) Authentication-Method (3): XAUTHInitPreShared (65001) Group-Description (4): Alternate 1024-bit MODP group (2) Key Exchange payload Next payload: Nonce (10) Payload length: 132 Key Exchange Data (128 bytes / 1024 bits) Nonce payload Next payload: Identification (5) Payload length: 20 Nonce Data Identification payload Next payload: Hash (8) Payload length: 12 ID type: 1 ID type: IPV4_ADDR (1) Protocol ID: Unused Port: Unused Identification data: Hash payload Next payload: Vendor ID (13) Payload length: 24 Hash Data Vendor ID: 4C5647392E312E3235353A425249434B3A392E312E323535 Next payload: NONE (0) Payload length: 28 Vendor ID: 4C5647392E312E3235353A425249434B3A392E312E323535 No. Time Source Destination Protocol Info 3 0.278350 ISAKMP Informational Frame 3 (82 bytes on wire, 82 bytes captured) Arrival Time: Feb 25, 2008 21:46:47.394505000 [Time delta from previous captured frame: 0.005085000 seconds] [Time delta from previous displayed frame: 0.005085000 seconds] [Time since reference or first frame: 0.278350000 seconds] Frame Number: 3 Frame Length: 82 bytes Capture Length: 82 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:isakmp] [Coloring Rule Name: UDP] [Coloring Rule String: udp] Ethernet II, Src: (), Dst: () Destination: () Address: () .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: () Address: () .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: (), Dst: () Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 68 Identification: 0x0000 (0) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xa022 [correct] [Good: True] [Bad : False] Source: () Destination: () User Datagram Protocol, Src Port: isakmp (500), Dst Port: isakmp (500) Source port: isakmp (500) Destination port: isakmp (500) Length: 48 Checksum: 0x426d [correct] [Good Checksum: True] [Bad Checksum: False] Internet Security Association and Key Management Protocol Initiator cookie: 37FFFD44A813ECF4 Responder cookie: 1140785502B1B6C2 Next payload: Notification (11) Version: 1.0 Exchange type: Informational (5) Flags: 0x00 .... ...0 = Not encrypted .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 40 Notification payload Next payload: NONE (0) Payload length: 12 Domain of interpretation: IPSEC (1) Protocol ID: ISAKMP (1) SPI Size: 0 Message type: INVALID-HASH-INFORMATION (23)