Payload Length: 16 ID Type: IPv4 Subnet (4) Protocol ID (UDP/TCP, etc...): 0 Port: 0 ID Data: Muenster_LAN/255.255.255.0 Payload Notification Next Payload: None Reserved: 00 Payload Length: 28 DOI: IPsec Protocol-ID: PROTO_ISAKMP Spi Size: 16 Notify Type: STATUS_INITIAL_CONTACT SPI: 4b 8d 9e f3 29 6d 0f b4 3e 30 84 bf f8 d0 9d ad ISAKMP Header Initiator COOKIE: 4b 8d 9e f3 29 6d 0f b4 Responder COOKIE: 3e 30 84 bf f8 d0 9d ad Next Payload: Hash Version: 1.0 Exchange Type: Quick Mode Flags: (Encryption) MessageID: 72E86967 Length: 332 IKE Recv RAW packet dump 4b 8d 9e f3 29 6d 0f b4 3e 30 84 bf f8 d0 9d ad | K...)m..>0...... 08 10 05 01 d1 89 59 ca 00 00 00 44 d9 04 a9 85 | ......Y....D.... 69 38 fc d6 7d e4 dd 94 e0 1b ca 1b 6d 80 62 a6 | i8..}.......m.b. 6f e9 19 ae 4b 3c d8 13 61 0b 8e 9f a8 6c 23 1d | o...K<..a....l#. 03 ab 87 b9 | .... RECV PACKET from Muenster_ISP ISAKMP Header Initiator COOKIE: 4b 8d 9e f3 29 6d 0f b4 Responder COOKIE: 3e 30 84 bf f8 d0 9d ad Next Payload: Hash Version: 1.0 Exchange Type: Informational Flags: (Encryption) MessageID: D18959CA Length: 68 AFTER DECRYPTION ISAKMP Header Initiator COOKIE: 4b 8d 9e f3 29 6d 0f b4 Responder COOKIE: 3e 30 84 bf f8 d0 9d ad Next Payload: Hash Version: 1.0 Exchange Type: Informational Flags: (Encryption) MessageID: D18959CA Length: 68 Payload Hash Next Payload: Notification Reserved: 00 Payload Length: 24 Data: bf 99 ea 11 7c d6 cd e4 13 d2 d1 f3 d7 fc b3 e6 35 f6 4e c0 Payload Notification Next Payload: None Reserved: 00 Payload Length: 16 DOI: IPsec Protocol-ID: PROTO_IPSEC_ESP Spi Size: 4 Notify Type: PAYLOAD_MALFORMED SPI: ee a1 c1 1c Apr 10 14:26:07 [IKEv1]: IP = 87.139.102.84, IKE_DECODE RECEIVED Message (msgid=d18959ca) with payloads : HDR + HASH (8) + NOTIFY (11) + NONE (0) total length : 68 Apr 10 14:26:07 [IKEv1 DEBUG]: Group = 87.139.102.84, IP = 87.139.102.84, processing hash payload Apr 10 14:26:07 [IKEv1 DEBUG]: Group = 87.139.102.84, IP = 87.139.102.84, processing notify payload Apr 10 14:26:07 [IKEv1]: Group = 87.139.102.84, IP = 87.139.102.84, Received non-routine Notify message: Payload malformed (16) 192.168.4.64Apr 10 14:26:11 [IKEv1 DEBUG]: Pitcher: received a key acquire message, spi 0x0 Apr 10 14:26:12 [IKEv1 DEBUG]: Group = 87.139.58.53, IP = 87.139.58.53, Sending keep-alive of type DPD R-U-THERE (seq number 0x468d274e) Apr 10 14:26:12 [IKEv1 DEBUG]: Group = 87.139.58.53, IP = 87.139.58.53, constructing blank hash payload Apr 10 14:26:12 [IKEv1 DEBUG]: Group = 87.139.58.53, IP = 87.139.58.53, constructing qm hash payload Apr 10 14:26:12 [IKEv1]: IP = 87.139.58.53, IKE_DECODE SENDING Message (msgid=86cd9ff3) with payloads : HDR + HASH (8) + NOTIFY (11) + NONE (0) total length : 84 BEFORE ENCRYPTION RAW PACKET DUMP on SEND 06 80 15 3e 0a d6 63 66 62 83 3f cf 7a 5c 42 5d | ...>..cfb.?.z\B] 08 10 05 00 f3 9f cd 86 1c 00 00 00 0b 00 00 18 | ................ 7f c2 c9 89 d6 ba 92 09 9e 87 00 54 6e 90 82 d7 | ..........Tn... 2c 87 e0 94 00 00 00 20 00 00 00 01 01 10 8d 28 | ,...... .......( 06 80 15 3e 0a d6 63 66 62 83 3f cf 7a 5c 42 5d | ...>..cfb.?.z\B] 46 8d 27 4e | F.'N ISAKMP Header Initiator COOKIE: 06 80 15 3e 0a d6 63 66 Responder COOKIE: 62 83 3f cf 7a 5c 42 5d Next Payload: Hash Version: 1.0 Exchange Type: Informational Flags: (none) MessageID: F39FCD86 Length: 469762048 Payload Hash Next Payload: Notification Reserved: 00 Payload Length: 24 Data: 7f c2 c9 89 d6 ba 92 09 9e 87 00 54 6e 90 82 d7 2c 87 e0 94 Payload Notification Next Payload: None Reserved: 00 Payload Length: 32 DOI: IPsec Protocol-ID: PROTO_ISAKMP Spi Size: 16 Notify Type: R_U_THERE SPI: 06 80 15 3e 0a d6 63 66 62 83 3f cf 7a 5c 42 5d Data: 46 8d 27 4e ISAKMP Header Initiator COOKIE: 06 80 15 3e 0a d6 63 66 Responder COOKIE: 62 83 3f cf 7a 5c 42 5d Next Payload: Hash Version: 1.0 Exchange Type: Informational Flags: (Encryption) MessageID: 86CD9FF3 Length: 84 IKE Recv RAW packet dump 06 80 15 3e 0a d6 63 66 62 83 3f cf 7a 5c 42 5d | ...>..cfb.?.z\B] 08 10 05 01 9e 0d 15 11 00 00 00 54 72 45 1b be | ...........TrE.. cd 4b c9 70 c2 54 72 c6 75 33 ab a9 e5 f7 48 aa | .K.p.Tr.u3....H. 88 bd a2 b4 80 3a 4b 1c 28 0f e2 14 39 45 9e 4d | .....:K.(...9E.M 1c 42 75 c9 bd eb 93 3e 80 6b 1b 74 5a 86 02 06 | .Bu....>.k.tZ... 71 b0 06 4d | q..M RECV PACKET from Passau_ISP ISAKMP Header Initiator COOKIE: 06 80 15 3e 0a d6 63 66 Responder COOKIE: 62 83 3f cf 7a 5c 42 5d Next Payload: Hash Version: 1.0 Exchange Type: Informational Flags: (Encryption) MessageID: 9E0D1511 Length: 84 AFTER DECRYPTION ISAKMP Header Initiator COOKIE: 06 80 15 3e 0a d6 63 66 Responder COOKIE: 62 83 3f cf 7a 5c 42 5d Next Payload: Hash Version: 1.0 Exchange Type: Informational Flags: (Encryption) MessageID: 9E0D1511 Length: 84 Payload Hash Next Payload: Notification Reserved: 00 Payload Length: 24 Data: 0b 62 44 6f 16 a3 91 d4 56 53 18 f0 2e d0 d7 28 e0 26 2f e3 Payload Notification Next Payload: None Reserved: 00 Payload Length: 32 DOI: IPsec Protocol-ID: PROTO_ISAKMP Spi Size: 16 Notify Type: R_U_THERE_ACK SPI: 06 80 15 3e 0a d6 63 66 62 83 3f cf 7a 5c 42 5d Data: 46 8d 27 4e Apr 10 14:26:12 [IKEv1]: IP = 87.139.58.53, IKE_DECODE RECEIVED Message (msgid=9e0d1511) with payloads : HDR + HASH (8) + NOTIFY (11) + NONE (0) total length : 84 Apr 10 14:26:12 [IKEv1 DEBUG]: Group = 87.139.58.53, IP = 87.139.58.53, processing hash payload Apr 10 14:26:12 [IKEv1 DEBUG]: Group = 87.139.58.53, IP = 87.139.58.53, processing notify payload Apr 10 14:26:12 [IKEv1 DEBUG]: Group = 87.139.58.53, IP = 87.139.58.53, Received keep-alive of type DPD R-U-THERE-ACK (seq number 0x468d274e) ISAKMP Header Initiator COOKIE: 4b 8d 9e f3 29 6d 0f b4 Responder COOKIE: 3e 30 84 bf f8 d0 9d ad Next Payload: Hash Version: 1.0 Exchange Type: Quick Mode Flags: (Encryption) MessageID: 72E86967 Length: 332 IKE Recv RAW packet dump 4b 8d 9e f3 29 6d 0f b4 3e 30 84 bf f8 d0 9d ad | K...)m..>0...... 08 10 05 01 c8 97 d6 cd 00 00 00 44 3d a3 b0 2f | ...........D=../ 51 02 2a 6b 6c 1b f7 46 8d 83 49 16 45 5c b3 85 | Q.*kl..F..I.E\.. a1 7a f9 5f 04 90 e7 cb ab 55 58 d4 ca fd 08 4f | .z._.....UX....O ea f8 36 30 | ..60 RECV PACKET from Muenster_ISP ISAKMP Header Initiator COOKIE: 4b 8d 9e f3 29 6d 0f b4 Responder COOKIE: 3e 30 84 bf f8 d0 9d ad Next Payload: Hash Version: 1.0 Exchange Type: Informational Flags: (Encryption) MessageID: C897D6CD Length: 68 AFTER DECRYPTION ISAKMP Header Initiator COOKIE: 4b 8d 9e f3 29 6d 0f b4 Responder COOKIE: 3e 30 84 bf f8 d0 9d ad Next Payload: Hash Version: 1.0 Exchange Type: Informational Flags: (Encryption) MessageID: C897D6CD Length: 68 Payload Hash Next Payload: Notification Reserved: 00 Payload Length: 24 Data: 6c 61 ad fa 40 40 df 75 2c 9c 6c 29 ae a1 ac d5 85 95 22 5b Payload Notification Next Payload: None Reserved: 00 Payload Length: 16 DOI: IPsec Protocol-ID: PROTO_IPSEC_ESP Spi Size: 4 Notify Type: PAYLOAD_MALFORMED SPI: ee a1 c1 1c Apr 10 14:26:15 [IKEv1]: IP = 87.139.102.84, IKE_DECODE RECEIVED Message (msgid=c897d6cd) with payloads : HDR + HASH (8) + NOTIFY (11) + NONE (0) total length : 68 Apr 10 14:26:15 [IKEv1 DEBUG]: Group = 87.139.102.84, IP = 87.139.102.84, processing hash payload Apr 10 14:26:15 [IKEv1 DEBUG]: Group = 87.139.102.84, IP = 87.139.102.84, processing notify payload Apr 10 14:26:15 [IKEv1]: Group = 87.139.102.84, IP = 87.139.102.84, Received non-routine Notify message: Payload malformed (16) ---------------------------------- -Second debug log 5 minutes later- ---------------------------------- ID Type: IPv4 Subnet (4) Protocol ID (UDP/TCP, etc...): 0 Port: 0 ID Data: Muenster_LAN/255.255.255.0 Payload Notification Next Payload: None Reserved: 00 Payload Length: 28 DOI: IPsec Protocol-ID: PROTO_ISAKMP Spi Size: 16 Notify Type: STATUS_INITIAL_CONTACT SPI: 21 dd ad 85 62 14 da 6d eb 7e 45 6d 2b 5e a2 53 ISAKMP Header Initiator COOKIE: 21 dd ad 85 62 14 da 6d Responder COOKIE: eb 7e 45 6d 2b 5e a2 53 Next Payload: Hash Version: 1.0 Exchange Type: Quick Mode Flags: (Encryption) MessageID: A514918D Length: 332 IKE Recv RAW packet dump 21 dd ad 85 62 14 da 6d eb 7e 45 6d 2b 5e a2 53 | !...b..m.~Em+^.S 08 10 05 01 f0 b6 5e 38 00 00 00 44 cf 63 9a 6f | ......^8...D.c.o 49 75 34 48 48 2f 04 b9 c4 b8 bc 72 6a e4 47 77 | Iu4HH/.....rj.Gw c9 2f 5b b6 1a f7 40 55 cb 03 a3 d4 4f 60 7a b8 | ./[...@U....O`z. ff a1 72 b9 | ..r. RECV PACKET from Muenster_ISP ISAKMP Header Initiator COOKIE: 21 dd ad 85 62 14 da 6d Responder COOKIE: eb 7e 45 6d 2b 5e a2 53 Next Payload: Hash Version: 1.0 Exchange Type: Informational Flags: (Encryption) MessageID: F0B65E38 Length: 68 AFTER DECRYPTION ISAKMP Header Initiator COOKIE: 21 dd ad 85 62 14 da 6d Responder COOKIE: eb 7e 45 6d 2b 5e a2 53 Next Payload: Hash Version: 1.0 Exchange Type: Informational Flags: (Encryption) MessageID: F0B65E38 Length: 68 Payload Hash Next Payload: Notification Reserved: 00 Payload Length: 24 Data: c2 fb 1a bd c3 54 49 cc 2d c6 df b1 a7 f8 7b 3e 2f b4 50 a6 Payload Notification Next Payload: None Reserved: 00 Payload Length: 16 DOI: IPsec Protocol-ID: PROTO_IPSEC_ESP Spi Size: 4 Notify Type: PAYLOAD_MALFORMED SPI: bc d8 10 bd Apr 10 14:28:31 [IKEv1]: IP = 87.139.102.84, IKE_DECODE RECEIVED Message (msgid=f0b65e38) with payloads : HDR + HASH (8) + NOTIFY (11) + NONE (0) total length : 68 Apr 10 14:28:31 [IKEv1 DEBUG]: Group = 87.139.102.84, IP = 87.139.102.84, processing hash payload Apr 10 14:28:31 [IKEv1 DEBUG]: Group = 87.139.102.84, IP = 87.139.102.84, processing notify payload Apr 10 14:28:31 [IKEv1]: Group = 87.139.102.84, IP = 87.139.102.84, Received non-routine Notify message: Payload malformed (16) Apr 10 14:28:32 [IKEv1 DEBUG]: Pitcher: received a key acquire message, spi 0x0 Apr 10 14:28:32 [IKEv1 DEBUG]: Group = 87.139.58.53, IP = 87.139.58.53, Sending keep-alive of type DPD R-U-THERE (seq number 0x468d275c) Apr 10 14:28:32 [IKEv1 DEBUG]: Group = 87.139.58.53, IP = 87.139.58.53, constructing blank hash payload Apr 10 14:28:32 [IKEv1 DEBUG]: Group = 87.139.58.53, IP = 87.139.58.53, constructing qm hash payload Apr 10 14:28:32 [IKEv1]: IP = 87.139.58.53, IKE_DECODE SENDING Message (msgid=d2e965f) with payloads : HDR + HASH (8) + NOTIFY (11) + NONE (0) total length : 84 BEFORE ENCRYPTION RAW PACKET DUMP on SEND 06 80 15 3e 0a d6 63 66 62 83 3f cf 7a 5c 42 5d | ...>..cfb.?.z\B] 08 10 05 00 5f 96 2e 0d 1c 00 00 00 0b 00 00 18 | ...._........... 09 2a 25 90 55 bf fe 27 c5 c3 e5 a7 46 89 d8 09 | .*%.U..'....F... e3 2d 85 30 00 00 00 20 00 00 00 01 01 10 8d 28 | .-.0... .......( 06 80 15 3e 0a d6 63 66 62 83 3f cf 7a 5c 42 5d | ...>..cfb.?.z\B] 46 8d 27 5c | F.'\ ISAKMP Header Initiator COOKIE: 06 80 15 3e 0a d6 63 66 Responder COOKIE: 62 83 3f cf 7a 5c 42 5d Next Payload: Hash Version: 1.0 Exchange Type: Informational Flags: (none) MessageID: 5F962E0D Length: 469762048 Payload Hash Next Payload: Notification Reserved: 00 Payload Length: 24 Data: 09 2a 25 90 55 bf fe 27 c5 c3 e5 a7 46 89 d8 09 e3 2d 85 30 Payload Notification Next Payload: None Reserved: 00 Payload Length: 32 DOI: IPsec Protocol-ID: PROTO_ISAKMP Spi Size: 16 Notify Type: R_U_THERE SPI: 06 80 15 3e 0a d6 63 66 62 83 3f cf 7a 5c 42 5d Data: 46 8d 27 5c ISAKMP Header Initiator COOKIE: 06 80 15 3e 0a d6 63 66 Responder COOKIE: 62 83 3f cf 7a 5c 42 5d Next Payload: Hash Version: 1.0 Exchange Type: Informational Flags: (Encryption) MessageID: 0D2E965F Length: 84 IKE Recv RAW packet dump 06 80 15 3e 0a d6 63 66 62 83 3f cf 7a 5c 42 5d | ...>..cfb.?.z\B] 08 10 05 01 4a 3a e5 a9 00 00 00 54 e9 5f a6 c0 | ....J:.....T._.. c2 df 2d 66 79 35 18 38 0e 79 bf 4c 74 69 c4 57 | ..-fy5.8.y.Lti.W 98 fb f9 36 7d d9 ce 6e 69 a7 3c a8 ab 4b 66 4f | ...6}..ni.<..KfO 8d 65 45 ef 13 58 39 a7 40 c4 0a 95 ef 86 af 5b | .eE..X9.@......[ 2d 04 06 54 | -..T RECV PACKET from Passau_ISP ISAKMP Header Initiator COOKIE: 06 80 15 3e 0a d6 63 66 Responder COOKIE: 62 83 3f cf 7a 5c 42 5d Next Payload: Hash Version: 1.0 Exchange Type: Informational Flags: (Encryption) MessageID: 4A3AE5A9 Length: 84 AFTER DECRYPTION ISAKMP Header Initiator COOKIE: 06 80 15 3e 0a d6 63 66 Responder COOKIE: 62 83 3f cf 7a 5c 42 5d Next Payload: Hash Version: 1.0 Exchange Type: Informational Flags: (Encryption) MessageID: 4A3AE5A9 Length: 84 Payload Hash Next Payload: Notification Reserved: 00 Payload Length: 24 Data: aa 64 cf ce 9a 57 ac 72 f5 ab 98 74 80 32 46 ca 08 bb 18 0f Payload Notification Next Payload: None Reserved: 00 Payload Length: 32 DOI: IPsec Protocol-ID: PROTO_ISAKMP Spi Size: 16 Notify Type: R_U_THERE_ACK SPI: 06 80 15 3e 0a d6 63 66 62 83 3f cf 7a 5c 42 5d Data: 46 8d 27 5c Apr 10 14:28:32 [IKEv1]: IP = 87.139.58.53, IKE_DECODE RECEIVED Message (msgid=4a3ae5a9) with payloads : HDR + HASH (8) + NOTIFY (11) + NONE (0) total length : 84 Apr 10 14:28:32 [IKEv1 DEBUG]: Group = 87.139.58.53, IP = 87.139.58.53, processing hash payload Apr 10 14:28:32 [IKEv1 DEBUG]: Group = 87.139.58.53, IP = 87.139.58.53, processing notify payload Apr 10 14:28:32 [IKEv1 DEBUG]: Group = 87.139.58.53, IP = 87.139.58.53, Received keep-alive of type DPD R-U-THERE-ACK (seq number 0x468d275c) Apr 10 14:28:37 [IKEv1 DEBUG]: Pitcher: received a key acquire message, spi 0x0 ISAKMP Header Initiator COOKIE: 21 dd ad 85 62 14 da 6d Responder COOKIE: eb 7e 45 6d 2b 5e a2 53 Next Payload: Hash Version: 1.0 Exchange Type: Quick Mode Flags: (Encryption) MessageID: A514918D Length: 332 IKE Recv RAW packet dump 21 dd ad 85 62 14 da 6d eb 7e 45 6d 2b 5e a2 53 | !...b..m.~Em+^.S 08 10 05 01 ea ef 38 dd 00 00 00 44 96 a6 16 4c | ......8....D...L 19 86 96 b5 b2 f1 ad b6 3d 77 c3 1b 3d be 03 ae | ........=w..=... d8 14 d2 c6 7e c0 8b fd 66 c9 75 50 da 63 53 e2 | ....~...f.uP.cS. 67 cc bf d9 | g... RECV PACKET from Muenster_ISP ISAKMP Header Initiator COOKIE: 21 dd ad 85 62 14 da 6d Responder COOKIE: eb 7e 45 6d 2b 5e a2 53 Next Payload: Hash Version: 1.0 Exchange Type: Informational Flags: (Encryption) MessageID: EAEF38DD Length: 68 AFTER DECRYPTION ISAKMP Header Initiator COOKIE: 21 dd ad 85 62 14 da 6d Responder COOKIE: eb 7e 45 6d 2b 5e a2 53 Next Payload: Hash Version: 1.0 Exchange Type: Informational Flags: (Encryption) MessageID: EAEF38DD Length: 68 Payload Hash Next Payload: Notification Reserved: 00 Payload Length: 24 Data: 62 63 44 82 12 7d 4e dd ea 91 e1 94 16 47 16 5b 39 6d b4 d1 Payload Notification Next Payload: None Reserved: 00 Payload Length: 16 DOI: IPsec Protocol-ID: PROTO_IPSEC_ESP Spi Size: 4 Notify Type: PAYLOAD_MALFORMED SPI: bc d8 10 bd Apr 10 14:28:39 [IKEv1]: IP = 87.139.102.84, IKE_DECODE RECEIVED Message (msgid=eaef38dd) with payloads : HDR + HASH (8) + NOTIFY (11) + NONE (0) total length : 68 Apr 10 14:28:39 [IKEv1 DEBUG]: Group = 87.139.102.84, IP = 87.139.102.84, processing hash payload Apr 10 14:28:39 [IKEv1 DEBUG]: Group = 87.139.102.84, IP = 87.139.102.84, processing notify payload Apr 10 14:28:39 [IKEv1]: Group = 87.139.102.84, IP = 87.139.102.84, Received non-routine Notify message: Payload malformed (16)