# IKE Service Detection and Version Identification

- **URL:** https://hackindex.io/services/ike/enumeration/ike-service-detection
- **Path:** IKE > Enumeration
- **Up:** [Enumeration](https://hackindex.io/services/ike/enumeration.md)
- **Published:** 2026-03-16
- **Updated:** 2026-03-30

## IKE Service Detection

IKE runs over UDP, which means standard TCP port scans miss it entirely. Nmap's default scan will not find a VPN gateway unless you explicitly target UDP. The first step is confirming the service is present and whether it speaks IKEv1, IKEv2, or both: that determines every follow-up check.

UDP 500 is the standard IKE port. UDP 4500 is IKE with NAT traversal (NAT-T), used when the gateway or client sits behind NAT. In practice, most modern gateways listen on both.

## Nmap UDP Detection

Nmap requires root for UDP scans. Use `-sU` with service version detection:

```bash
sudo nmap -sU -p 500,4500 -sV $TARGET_IP
# PORT     STATE         SERVICE VERSION
# 500/udp  open          isakmp  Microsoft Windows ISAKMP
# 4500/udp open|filtered nat-t-ike
```

`open` on 500 confirms IKE is responding. `open|filtered` on 4500 is normal: UDP probes do not always get a response unless the gateway is actively listening for NAT-T.

For a broader sweep when the port is unknown:

```bash
sudo nmap -sU -p 500,4500,1701,4501 -sV $TARGET_IP
```

## ike-scan: Primary Tool

ike-scan is purpose-built for IKE enumeration. It sends crafted IKE packets and parses the gateway's response, which tells you more than Nmap's generic UDP probe.

Basic probe against UDP 500:

```bash
sudo ike-scan $TARGET_IP
# Starting ike-scan 1.9.4 with 1 hosts (http://www.nta-monitor.com/tools/ike-scan/)
# 10.10.10.5	Main Mode Handshake returned
# 	HDR=(CKY-R=abc123def456)
# 	SA=(Enc=3DES Hash=SHA1 Auth=PSK Group=2:modp1024 LifeType=Seconds LifeDuration=28800)
# 	VID=...
#
# Ending ike-scan 1.9.4: 1 hosts scanned in 0.412 seconds (2.43 hosts/sec); 1 returned handshake; 0 returned notify
```

`Main Mode Handshake returned` confirms IKEv1 is active and responding. The SA line shows the first accepted transform: this feeds directly into transform set enumeration.

Probe NAT-T on 4500:

```bash
sudo ike-scan --sport=0 --nat-t $TARGET_IP
```

## Confirm IKEv2

IKEv2 uses a different packet format. ike-scan has a dedicated flag:

```bash
sudo ike-scan --ikev2 $TARGET_IP
# 10.10.10.5	IKEv2 SA_INIT returned
# 	HDR=(...) SA=(...) KE=(...) Ni=(...)
```

A response here means IKEv2 is supported. If the gateway responds to both IKEv1 and IKEv2 probes, note both: the IKEv1 attack surface is more interesting regardless.

If neither probe returns a handshake but the port is open, the gateway may require a specific peer identity or source IP before responding. Try with a spoofed or matched ID:

```bash
sudo ike-scan --id=$DOMAIN $TARGET_IP
```

## Read What the Response Tells You

From an initial ike-scan response, record:

- **Version**: IKEv1 Main Mode, IKEv1 Aggressive Mode, or IKEv2
- **Auth method**: PSK (pre-shared key) or RSA signatures. PSK is the interesting one: it is crackable in Aggressive Mode
- **Proposed transforms**: the first cipher/hash/DH group the gateway accepted
- **VID payloads**: vendor identification strings: covered in [IKE Vendor ID Fingerprinting](https://hackindex.io/services/ike/enumeration/ike-vendor-id-fingerprinting)

If the gateway responds only to Aggressive Mode and not Main Mode, that is a vulnerability finding on its own: covered in [IKEv1 Aggressive Mode Enabled](https://hackindex.io/services/ike/vulnerability-discovery/ike-aggressive-mode-enabled).

## References

- [NTA Monitor: ike-scan](https://www.nta-monitor.com/tools-resources/security-tools/ike-scan) - Official documentation and usage guide for ike-scan, the primary IKE enumeration tool
- [Nmap: UDP Scanning](https://nmap.org/book/man-port-scanning-techniques.html) - Reference for -sU UDP scan technique and limitations with stateless protocols