####openbsd box##### root@OpenBSD61-VM-4:/root # tcpdump -ni em1 host 10.0.0.16 tcpdump: listening on em1, link-type EN10MB 14:41:43.726474 172.16.0.3.4500 > 10.0.0.16.4500:udpencap: esp 172.16.0.3 > 10.0.0.16 spi 0xcc60d6ed seq 22 len 136 14:41:44.696051 172.16.0.3.4500 > 10.0.0.16.4500:NAT-T Keepalive 14:41:44.735783 172.16.0.3.4500 > 10.0.0.16.4500:udpencap: esp 172.16.0.3 > 10.0.0.16 spi 0xcc60d6ed seq 23 len 136 14:41:45.726112 172.16.0.3.4500 > 10.0.0.16.4500:udpencap: esp 172.16.0.3 > 10.0.0.16 spi 0xcc60d6ed seq 24 len 136 14:41:46.676652 172.16.0.3.4500 > 10.0.0.16.4500:udpencap: isakmp v1.0 exchange INFO encrypted cookie: b0e168cb769497e7->dc1178bf96080c15 msgid: 02790051 len: 108 14:41:46.687415 10.0.0.16.4500 > 172.16.0.3.4500:udpencap: isakmp v1.0 exchange INFO encrypted cookie: b0e168cb769497e7->dc1178bf96080c15 msgid: 0a476c8d len: 108 (DF) 14:41:46.725127 172.16.0.3.4500 > 10.0.0.16.4500:udpencap: esp 172.16.0.3 > 10.0.0.16 spi 0xcc60d6ed seq 25 len 136 14:41:47.725354 172.16.0.3.4500 > 10.0.0.16.4500:udpencap: esp 172.16.0.3 > 10.0.0.16 spi 0xcc60d6ed seq 26 len 136 14:41:48.724472 172.16.0.3.4500 > 10.0.0.16.4500:udpencap: esp 172.16.0.3 > 10.0.0.16 spi 0xcc60d6ed seq 27 len 136 ####ubuntu-server###### root@ubuntu-vpn-gw:~# tcpdump -ni enp0s8 host 10.0.0.100 14:42:42.789559 IP 10.0.0.100.4500 > 10.0.0.16.4500: isakmp-nat-keep-alive 14:42:42.830415 IP 10.0.0.100.4500 > 10.0.0.16.4500: UDP-encap: ESP(spi=0xcc60d6ed,seq=0x17), length 136 14:42:43.821356 IP 10.0.0.100.4500 > 10.0.0.16.4500: UDP-encap: ESP(spi=0xcc60d6ed,seq=0x18), length 136 14:42:44.771309 IP 10.0.0.100.4500 > 10.0.0.16.4500: NONESP-encap: isakmp: phase 2/others ? inf[E] 14:42:44.777256 IP 10.0.0.16.4500 > 10.0.0.100.4500: NONESP-encap: isakmp: phase 2/others ? inf[E] 14:42:44.819234 IP 10.0.0.100.4500 > 10.0.0.16.4500: UDP-encap: ESP(spi=0xcc60d6ed,seq=0x19), length 136 14:42:45.821803 IP 10.0.0.100.4500 > 10.0.0.16.4500: UDP-encap: ESP(spi=0xcc60d6ed,seq=0x1a), length 136 14:42:46.822675 IP 10.0.0.100.4500 > 10.0.0.16.4500: UDP-encap: ESP(spi=0xcc60d6ed,seq=0x1b), length 136 14:42:49.795317 IP 10.0.0.100.4500 > 10.0.0.16.4500: NONESP-encap: isakmp: phase 2/others ? inf[E] 14:42:49.796441 IP 10.0.0.16.4500 > 10.0.0.100.4500: NONESP-encap: isakmp: phase 2/others ? inf[E] 14:42:54.818747 IP 10.0.0.100.4500 > 10.0.0.16.4500: NONESP-encap: isakmp: phase 2/others ? inf[E] 14:42:54.823096 IP 10.0.0.16.4500 > 10.0.0.100.4500: NONESP-encap: isakmp: phase 2/others ? inf[E] 14:42:59.842896 IP 10.0.0.100.4500 > 10.0.0.16.4500: NONESP-encap: isakmp: phase 2/others ? inf[E] 14:42:59.844659 IP 10.0.0.16.4500 > 10.0.0.100.4500: NONESP-encap: isakmp: phase 2/others ? inf[E] 14:43:02.813497 IP 10.0.0.100.4500 > 10.0.0.16.4500: isakmp-nat-keep-alive