Frame 30 (170 bytes on wire, 170 bytes captured) Arrival Time: Jan 20, 2006 09:33:02.921928000 Time delta from previous packet: 14.835235000 seconds Time since reference or first frame: 94.958759000 seconds Frame Number: 30 Packet Length: 170 bytes Capture Length: 170 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:0c:29:9e:5c:5f, Dst: 00:0c:29:7a:d4:aa Destination: 00:0c:29:7a:d4:aa (00:0c:29:7a:d4:aa) Source: 00:0c:29:9e:5c:5f (00:0c:29:9e:5c:5f) Type: IP (0x0800) Internet Protocol, Src Addr: 10.110.110.128 (10.110.110.128), Dst Addr: 10.110.110.129 (10.110.110.129) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 156 Identification: 0x4168 (16744) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: UDP (0x11) Header checksum: 0x070c (correct) Source: 10.110.110.128 (10.110.110.128) Destination: 10.110.110.129 (10.110.110.129) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 136 Checksum: 0x03d9 (correct) Internet Security Association and Key Management Protocol Initiator cookie: 0xA055EBD8796A4534 Responder cookie: 0x0000000000000000 Next payload: Security Association (1) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...0 = No encryption .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 128 Security Association payload Next payload: Vendor ID (13) Length: 56 Domain of interpretation: IPSEC (1) Situation: IDENTITY (1) Proposal payload # 1 Next payload: NONE (0) Length: 44 Proposal number: 1 Protocol ID: ISAKMP (1) SPI size: 0 Number of transforms: 1 Transform payload # 1 Next payload: NONE (0) Length: 36 Transform number: 1 Transform ID: KEY_IKE (1) Encryption-Algorithm (1): 3DES-CBC (5) Hash-Algorithm (2): SHA (2) Authentication-Method (3): PSK (1) Group-Description (4): Alternate 1024-bit MODP group (2) Life-Type (11): Seconds (1) Life-Duration (12): Duration-Value (86400) Vendor ID payload Next payload: NONE (0) Length: 44 Vendor ID: Check Point Check Point Product: VPN-1 Version: NG with Application Intelligence R55 Check Point Vendor ID parameters Frame 31 (146 bytes on wire, 146 bytes captured) Arrival Time: Jan 20, 2006 09:33:03.550996000 Time delta from previous packet: 0.629068000 seconds Time since reference or first frame: 95.587827000 seconds Frame Number: 31 Packet Length: 146 bytes Capture Length: 146 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:0c:29:7a:d4:aa, Dst: 00:0c:29:9e:5c:5f Destination: 00:0c:29:9e:5c:5f (00:0c:29:9e:5c:5f) Source: 00:0c:29:7a:d4:aa (00:0c:29:7a:d4:aa) Type: IP (0x0800) Internet Protocol, Src Addr: 10.110.110.129 (10.110.110.129), Dst Addr: 10.110.110.128 (10.110.110.128) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 132 Identification: 0x0000 (0) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0x488c (correct) Source: 10.110.110.129 (10.110.110.129) Destination: 10.110.110.128 (10.110.110.128) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 112 Checksum: 0x46e5 (correct) Internet Security Association and Key Management Protocol Initiator cookie: 0xA055EBD8796A4534 Responder cookie: 0x806E1C4682FC16F4 Next payload: Security Association (1) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...0 = No encryption .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 104 Security Association payload Next payload: Vendor ID (13) Length: 56 Domain of interpretation: IPSEC (1) Situation: IDENTITY (1) Proposal payload # 1 Next payload: NONE (0) Length: 44 Proposal number: 1 Protocol ID: ISAKMP (1) SPI size: 0 Number of transforms: 1 Transform payload # 1 Next payload: NONE (0) Length: 36 Transform number: 1 Transform ID: KEY_IKE (1) Encryption-Algorithm (1): 3DES-CBC (5) Hash-Algorithm (2): SHA (2) Authentication-Method (3): PSK (1) Group-Description (4): Alternate 1024-bit MODP group (2) Life-Type (11): Seconds (1) Life-Duration (12): Duration-Value (86400) Vendor ID payload Next payload: NONE (0) Length: 20 Vendor ID: RFC 3706 Detecting Dead IKE Peers (DPD) Frame 32 (226 bytes on wire, 226 bytes captured) Arrival Time: Jan 20, 2006 09:33:03.555286000 Time delta from previous packet: 0.004290000 seconds Time since reference or first frame: 95.592117000 seconds Frame Number: 32 Packet Length: 226 bytes Capture Length: 226 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:0c:29:9e:5c:5f, Dst: 00:0c:29:7a:d4:aa Destination: 00:0c:29:7a:d4:aa (00:0c:29:7a:d4:aa) Source: 00:0c:29:9e:5c:5f (00:0c:29:9e:5c:5f) Type: IP (0x0800) Internet Protocol, Src Addr: 10.110.110.128 (10.110.110.128), Dst Addr: 10.110.110.129 (10.110.110.129) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 212 Identification: 0x4169 (16745) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: UDP (0x11) Header checksum: 0x06d3 (correct) Source: 10.110.110.128 (10.110.110.128) Destination: 10.110.110.129 (10.110.110.129) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 192 Checksum: 0xaca1 (correct) Internet Security Association and Key Management Protocol Initiator cookie: 0xA055EBD8796A4534 Responder cookie: 0x806E1C4682FC16F4 Next payload: Key Exchange (4) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...0 = No encryption .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 184 Key Exchange payload Next payload: Nonce (10) Length: 132 Key Exchange Data Nonce payload Next payload: NONE (0) Length: 24 Nonce Data Frame 33 (222 bytes on wire, 222 bytes captured) Arrival Time: Jan 20, 2006 09:33:03.730628000 Time delta from previous packet: 0.175342000 seconds Time since reference or first frame: 95.767459000 seconds Frame Number: 33 Packet Length: 222 bytes Capture Length: 222 bytes Protocols in frame: eth:ip:udp:isakmp Ethernet II, Src: 00:0c:29:7a:d4:aa, Dst: 00:0c:29:9e:5c:5f Destination: 00:0c:29:9e:5c:5f (00:0c:29:9e:5c:5f) Source: 00:0c:29:7a:d4:aa (00:0c:29:7a:d4:aa) Type: IP (0x0800) Internet Protocol, Src Addr: 10.110.110.129 (10.110.110.129), Dst Addr: 10.110.110.128 (10.110.110.128) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 208 Identification: 0x0001 (1) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0x483f (correct) Source: 10.110.110.129 (10.110.110.129) Destination: 10.110.110.128 (10.110.110.128) User Datagram Protocol, Src Port: 500 (500), Dst Port: 500 (500) Source port: 500 (500) Destination port: 500 (500) Length: 188 Checksum: 0x5e88 (correct) Internet Security Association and Key Management Protocol Initiator cookie: 0xA055EBD8796A4534 Responder cookie: 0x806E1C4682FC16F4 Next payload: Key Exchange (4) Version: 1.0 Exchange type: Identity Protection (Main Mode) (2) Flags .... ...0 = No encryption .... ..0. = No commit .... .0.. = No authentication Message ID: 0x00000000 Length: 180 Key Exchange payload Next payload: Nonce (10) Length: 132 Key Exchange Data Nonce payload Next payload: NONE (0) Length: 20 Nonce Data