Skip to content
HackIndex.io

IKE Service Detection and Version Identification

4 min read Created Mar 16, 2026 Last updated Mar 30, 2026

IKE Service Detection

IKE runs over UDP, which means standard TCP port scans miss it entirely. Nmap's default scan will not find a VPN gateway unless you explicitly target UDP. The first step is confirming the service is present and whether it speaks IKEv1, IKEv2, or both: that determines every follow-up check.

UDP 500 is the standard IKE port. UDP 4500 is IKE with NAT traversal (NAT-T), used when the gateway or client sits behind NAT. In practice, most modern gateways listen on both.

Nmap UDP Detection

Nmap requires root for UDP scans. Use -sU with service version detection:

┌──(kali㉿kali)-[~]
└─$ sudo nmap -sU -p 500,4500 -sV $TARGET_IP 
PORT     STATE         SERVICE VERSION
500/udp  open          isakmp  Microsoft Windows ISAKMP
4500/udp open|filtered nat-t-ike
Explain command
-sU Performs a UDP scan instead of default TCP scan.
-p 500,4500 Scans only ports 500 (IKE) and 4500 (IPsec NAT-T).
-sV Probes open ports to detect service version information.
$TARGET_IP Placeholder for the target host IP address.

open on 500 confirms IKE is responding. open|filtered on 4500 is normal: UDP probes do not always get a response unless the gateway is actively listening for NAT-T.

For a broader sweep when the port is unknown:

┌──(kali㉿kali)-[~]
└─$ sudo nmap -sU -p 500,4500,1701,4501 -sV $TARGET_IP
Explain command
-sU Performs a UDP scan instead of the default TCP scan.
-p 500,4500,1701,4501 Scans specific ports: IKE, NAT-T, L2TP, and alternate NAT-T.
-sV Enables version detection to identify services on open ports.
$TARGET_IP Placeholder for the target host IP address.

ike-scan: Primary Tool

ike-scan is purpose-built for IKE enumeration. It sends crafted IKE packets and parses the gateway's response, which tells you more than Nmap's generic UDP probe.

Basic probe against UDP 500:

┌──(kali㉿kali)-[~]
└─$ sudo ike-scan $TARGET_IP 
Starting ike-scan 1.9.4 with 1 hosts (http://www.nta-monitor.com/tools/ike-scan/)
10.10.10.5	Main Mode Handshake returned
	HDR=(CKY-R=abc123def456)
	SA=(Enc=3DES Hash=SHA1 Auth=PSK Group=2:modp1024 LifeType=Seconds LifeDuration=28800)
	VID=...

Ending ike-scan 1.9.4: 1 hosts scanned in 0.412 seconds (2.43 hosts/sec); 1 returned handshake; 0 returned notify

Main Mode Handshake returned confirms IKEv1 is active and responding. The SA line shows the first accepted transform: this feeds directly into transform set enumeration.

Probe NAT-T on 4500:

┌──(kali㉿kali)-[~]
└─$ sudo ike-scan --sport=0 --nat-t $TARGET_IP
Explain command
--sport=0 Set source UDP port to 0, letting OS assign an ephemeral port.
--nat-t Use NAT-Traversal encapsulation (IKE over UDP port 4500).
$TARGET_IP Target host IP address variable for the IKE scan.

Confirm IKEv2

IKEv2 uses a different packet format. ike-scan has a dedicated flag:

┌──(kali㉿kali)-[~]
└─$ sudo ike-scan --ikev2 $TARGET_IP 
10.10.10.5	IKEv2 SA_INIT returned
	HDR=(...) SA=(...) KE=(...) Ni=(...)
Explain command
--ikev2 Use IKEv2 (Internet Key Exchange version 2) protocol for scanning.
$TARGET_IP Target host IP address to probe for IKEv2 VPN services.

A response here means IKEv2 is supported. If the gateway responds to both IKEv1 and IKEv2 probes, note both: the IKEv1 attack surface is more interesting regardless.

If neither probe returns a handshake but the port is open, the gateway may require a specific peer identity or source IP before responding. Try with a spoofed or matched ID:

┌──(kali㉿kali)-[~]
└─$ sudo ike-scan --id=$DOMAIN $TARGET_IP
Explain command
--id=$DOMAIN Sets the IKE identity payload to the specified domain value.
$TARGET_IP Target IP address to send IKE probes to.

Read What the Response Tells You

From an initial ike-scan response, record:

  • Version: IKEv1 Main Mode, IKEv1 Aggressive Mode, or IKEv2

  • Auth method: PSK (pre-shared key) or RSA signatures. PSK is the interesting one: it is crackable in Aggressive Mode

  • Proposed transforms: the first cipher/hash/DH group the gateway accepted

  • VID payloads: vendor identification strings: covered in IKE Vendor ID Fingerprinting

If the gateway responds only to Aggressive Mode and not Main Mode, that is a vulnerability finding on its own: covered in IKEv1 Aggressive Mode Enabled.

References