Skip to content
HackIndex logo

HackIndex

IKE Service Detection and Version Identification

4 min read Mar 30, 2026

IKE runs over UDP, which means standard TCP port scans miss it entirely. Nmap's default scan will not find a VPN gateway unless you explicitly target UDP. The first step is confirming the service is present and whether it speaks IKEv1, IKEv2, or both — that determines every follow-up check.

UDP 500 is the standard IKE port. UDP 4500 is IKE with NAT traversal (NAT-T), used when the gateway or client sits behind NAT. In practice, most modern gateways listen on both.

Nmap UDP Detection

Nmap requires root for UDP scans. Use -sU with service version detection:

┌──(kali㉿kali)-[~]
└─$ sudo nmap -sU -p 500,4500 -sV $TARGET_IP 
PORT     STATE         SERVICE VERSION
500/udp  open          isakmp  Microsoft Windows ISAKMP
4500/udp open|filtered nat-t-ike
Explain command
-sU Performs a UDP scan instead of default TCP scan.
-p 500,4500 Scans only ports 500 (IKE) and 4500 (IPsec NAT-T).
-sV Probes open ports to detect service version information.
$TARGET_IP Placeholder for the target host IP address.

open on 500 confirms IKE is responding. open|filtered on 4500 is normal — UDP probes do not always get a response unless the gateway is actively listening for NAT-T.

For a broader sweep when the port is unknown:

┌──(kali㉿kali)-[~]
└─$ sudo nmap -sU -p 500,4500,1701,4501 -sV $TARGET_IP
Explain command
-sU Performs a UDP scan instead of the default TCP scan.
-p 500,4500,1701,4501 Scans specific ports: IKE, NAT-T, L2TP, and alternate NAT-T.
-sV Enables version detection to identify services on open ports.
$TARGET_IP Placeholder for the target host IP address.

ike-scan — Primary Tool

ike-scan is purpose-built for IKE enumeration. It sends crafted IKE packets and parses the gateway's response, which tells you more than Nmap's generic UDP probe.

Basic probe against UDP 500:

┌──(kali㉿kali)-[~]
└─$ sudo ike-scan $TARGET_IP 
Starting ike-scan 1.9.4 with 1 hosts (http://www.nta-monitor.com/tools/ike-scan/)
10.10.10.5	Main Mode Handshake returned
	HDR=(CKY-R=abc123def456)
	SA=(Enc=3DES Hash=SHA1 Auth=PSK Group=2:modp1024 LifeType=Seconds LifeDuration=28800)
	VID=...

Ending ike-scan 1.9.4: 1 hosts scanned in 0.412 seconds (2.43 hosts/sec); 1 returned handshake; 0 returned notify

Main Mode Handshake returned confirms IKEv1 is active and responding. The SA line shows the first accepted transform — this feeds directly into transform set enumeration.

Probe NAT-T on 4500:

┌──(kali㉿kali)-[~]
└─$ sudo ike-scan --sport=0 --nat-t $TARGET_IP
Explain command
--sport=0 Set source UDP port to 0, letting OS assign an ephemeral port.
--nat-t Use NAT-Traversal encapsulation (IKE over UDP port 4500).
$TARGET_IP Target host IP address variable for the IKE scan.

Confirm IKEv2

IKEv2 uses a different packet format. ike-scan has a dedicated flag:

┌──(kali㉿kali)-[~]
└─$ sudo ike-scan --ikev2 $TARGET_IP 
10.10.10.5	IKEv2 SA_INIT returned
	HDR=(...) SA=(...) KE=(...) Ni=(...)
Explain command
--ikev2 Use IKEv2 (Internet Key Exchange version 2) protocol for scanning.
$TARGET_IP Target host IP address to probe for IKEv2 VPN services.

A response here means IKEv2 is supported. If the gateway responds to both IKEv1 and IKEv2 probes, note both — the IKEv1 attack surface is more interesting regardless.

If neither probe returns a handshake but the port is open, the gateway may require a specific peer identity or source IP before responding. Try with a spoofed or matched ID:

┌──(kali㉿kali)-[~]
└─$ sudo ike-scan --id=$DOMAIN $TARGET_IP
Explain command
--id=$DOMAIN Sets the IKE identity payload to the specified domain value.
$TARGET_IP Target IP address to send IKE probes to.

Read What the Response Tells You

From an initial ike-scan response, record:

  • Version: IKEv1 Main Mode, IKEv1 Aggressive Mode, or IKEv2

  • Auth method: PSK (pre-shared key) or RSA signatures. PSK is the interesting one — it is crackable in Aggressive Mode

  • Proposed transforms: the first cipher/hash/DH group the gateway accepted

  • VID payloads: vendor identification strings — covered in IKE Vendor ID Fingerprinting

If the gateway responds only to Aggressive Mode and not Main Mode, that is a vulnerability finding on its own — covered in IKEv1 Aggressive Mode Enabled.

References