# tcpdump -nvs1400 -i xl1 port 500 
tcpdump: listening on xl1, link-type EN10MB
13:32:57.080088 201.12.35.53.500 > 201.77.95.20.500: [udp sum ok] isakmp v1.0 exchange ID_PROT
        cookie: e2e253287bbac8c6->0000000000000000 msgid: 00000000 len: 176
        payload: SA len: 48 DOI: 1(IPSEC) situation: IDENTITY_ONLY 
            payload: PROPOSAL len: 36 proposal: 1 proto: ISAKMP spisz: 0 xforms: 1
                payload: TRANSFORM len: 28
                    transform: 0 ID: ISAKMP
                        attribute ENCRYPTION_ALGORITHM = DES_CBC
                        attribute HASH_ALGORITHM = SHA
                        attribute AUTHENTICATION_METHOD = PRE_SHARED
                        attribute GROUP_DESCRIPTION = MODP_1024
                        attribute LIFE_TYPE = SECONDS
        payload: VENDOR len: 20 (supports OpenBSD-4.0)
        payload: VENDOR len: 20 (supports v2 NAT-T, draft-ietf-ipsec-nat-t-ike-02)
        payload: VENDOR len: 20 (supports v3 NAT-T, draft-ietf-ipsec-nat-t-ike-03)
        payload: VENDOR len: 20 (supports NAT-T, RFC 3947)
        payload: VENDOR len: 20 (supports DPD v1.0) (ttl 64, id 2011, len 204)
13:32:57.143843 201.77.95.20.500 > 201.12.35.53.500: [udp sum ok] isakmp v1.0 exchange ID_PROT
        cookie: e2e253287bbac8c6->77f1d962e0751ce7 msgid: 00000000 len: 76
        payload: SA len: 48 DOI: 1(IPSEC) situation: IDENTITY_ONLY 
            payload: PROPOSAL len: 36 proposal: 1 proto: ISAKMP spisz: 0 xforms: 1
                payload: TRANSFORM len: 28
                    transform: 1 ID: ISAKMP
                        attribute ENCRYPTION_ALGORITHM = DES_CBC
                        attribute HASH_ALGORITHM = SHA
                        attribute AUTHENTICATION_METHOD = PRE_SHARED
                        attribute GROUP_DESCRIPTION = MODP_1024
                        attribute LIFE_TYPE = SECONDS (DF) (ttl 55, id 5753, len 104)
13:32:57.174334 201.12.35.53.500 > 201.77.95.20.500: [udp sum ok] isakmp v1.0 exchange ID_PROT
        cookie: e2e253287bbac8c6->77f1d962e0751ce7 msgid: 00000000 len: 180
        payload: KEY_EXCH len: 132
        payload: NONCE len: 20 (ttl 64, id 14311, len 208)
13:32:57.231489 201.77.95.20.500 > 201.12.35.53.500: [udp sum ok] isakmp v1.0 exchange ID_PROT
        cookie: e2e253287bbac8c6->77f1d962e0751ce7 msgid: 00000000 len: 184
        payload: KEY_EXCH len: 132
        payload: NONCE len: 24 (DF) (ttl 55, id 5754, len 212)
13:32:57.283891 201.12.35.53.500 > 201.77.95.20.500: [udp sum ok] isakmp v1.0 exchange ID_PROT encrypted
        cookie: e2e253287bbac8c6->77f1d962e0751ce7 msgid: 00000000 len: 92 (ttl 64, id 4526, len 120)
13:32:57.341790 201.77.95.20.500 > 201.12.35.53.500: [udp sum ok] isakmp v1.0 exchange ID_PROT encrypted
        cookie: e2e253287bbac8c6->77f1d962e0751ce7 msgid: 00000000 len: 68 (DF) (ttl 55, id 5755, len 96)
13:32:57.350840 201.12.35.53.500 > 201.77.95.20.500: [udp sum ok] isakmp v1.0 exchange QUICK_MODE encrypted
        cookie: e2e253287bbac8c6->77f1d962e0751ce7 msgid: a2fe5bea len: 148 (ttl 64, id 56257, len 176)
13:32:57.405323 201.77.95.20.500 > 201.12.35.53.500: [udp sum ok] isakmp v1.0 exchange INFO encrypted
        cookie: e2e253287bbac8c6->77f1d962e0751ce7 msgid: 815955b3 len: 76 (DF) (ttl 55, id 5756, len 104)
13:33:04.366329 201.12.35.53.500 > 201.77.95.20.500: [udp sum ok] isakmp v1.0 exchange QUICK_MODE encrypted
        cookie: e2e253287bbac8c6->77f1d962e0751ce7 msgid: a2fe5bea len: 148 (ttl 64, id 34262, len 176)
13:33:13.376557 201.12.35.53.500 > 201.77.95.20.500: [udp sum ok] isakmp v1.0 exchange QUICK_MODE encrypted
        cookie: e2e253287bbac8c6->77f1d962e0751ce7 msgid: a2fe5bea len: 148 (ttl 64, id 56996, len 176)
13:33:24.386930 201.12.35.53.500 > 201.77.95.20.500: [udp sum ok] isakmp v1.0 exchange QUICK_MODE encrypted
        cookie: e2e253287bbac8c6->77f1d962e0751ce7 msgid: a2fe5bea len: 148 (ttl 64, id 31250, len 176)