# IKE Vendor ID Fingerprinting

- **URL:** https://hackindex.io/services/ike/enumeration/ike-vendor-id-fingerprinting
- **Path:** IKE > Enumeration
- **Up:** [Enumeration](https://hackindex.io/services/ike/enumeration.md)
- **Published:** 2026-03-16
- **Updated:** 2026-03-30

IKE gateways include Vendor ID (VID) payloads in their handshake responses. These are MD5 hashes or fixed byte strings that identify the software implementation: Cisco, Checkpoint, Fortinet, strongSwan, openswan, and others all have known VID signatures. Matching a VID to a known product tells you what CVEs to check, what default credentials to try, and how the implementation behaves under unusual inputs.

## Extract VIDs with ike-scan

ike-scan prints VID payloads by default when it receives a handshake response:

```bash
sudo ike-scan $TARGET_IP
# 10.10.10.5	Main Mode Handshake returned
# 	HDR=(CKY-R=abc123def456)
# 	SA=(Enc=3DES Hash=SHA1 Auth=PSK Group=2:modp1024 LifeType=Seconds LifeDuration=28800)
# 	VID=afcad71368a1f1c96b8696fc77570100 (Dead Peer Detection v1.0)
# 	VID=090000233b7e24e28d6f2e5a84d7232e (Cisco Unity)
# 	VID=12f5f28c457168a9702d9fe274cc0100 (Cisco VPN Concentrator)
```

Each `VID=` line is a vendor identification payload. The hex string is the raw value; ike-scan decodes known ones automatically.

Force more verbose VID output:

```bash
sudo ike-scan -v $TARGET_IP
```

## Fingerprint with the --showbackoff Flag

Some implementations include timing characteristics that identify them. The `--showbackoff` flag measures how the gateway retransmits IKE packets:

```bash
sudo ike-scan --showbackoff $TARGET_IP
# 10.10.10.5	Implementation guess: Cisco VPN Concentrator 3000
# 	Retransmit pattern:  0 5 15 34 74
```

Timing patterns are a secondary signal: use them when VIDs are minimal or absent.

## ike-scan VID Database

ike-scan ships with a local VID database. Check it for a match manually if automatic decoding fails:

```bash
cat /usr/share/ike-scan/ike-vendor-ids | grep -i cisco
cat /usr/share/ike-scan/ike-vendor-ids | grep -i fortinet
cat /usr/share/ike-scan/ike-vendor-ids | grep -i checkpoint
```

If the raw hex is not decoded automatically, copy it and search manually:

```bash
grep "090000233b7e24e2" /usr/share/ike-scan/ike-vendor-ids
```

## What VIDs Reveal

| VID / String | Product |
| --- | --- |
| Cisco Unity VID | Cisco VPN Concentrator / ASA |
| XAUTH VID | Extended authentication (XAUTH) supported: credential attacks possible |
| Dead Peer Detection | DPD keepalives: useful for knowing tunnel state |
| strongSwan VID | Linux strongSwan: check version against CVEs |
| openswan VID | Linux openswan: check version against CVEs |
| Checkpoint VID | Check Point firewall/VPN |
| Heartbeat Notify | Some Fortinet implementations |

XAUTH support is particularly notable: if the gateway supports XAUTH (Extended Authentication), it may accept username/password after PSK negotiation, opening credential brute-force paths beyond PSK cracking.

## Follow-up from VID Results

Once you have a product identification:

- Search for known CVEs against that specific product and version
- Check vendor default PSK values and common PSK wordlists for that platform
- Look up whether that version has known Aggressive Mode weaknesses
- Check if XAUTH is indicated: if so, credential attacks against the VPN login are in scope

Version information from VIDs feeds directly into [IKEv1 Only Support Check](https://hackindex.io/services/ike/vulnerability-discovery/ike-ikev1-only) and the exploitation phase.

## References

- [ NTA Monitor: ike-scan](https://www.nta-monitor.com/tools-resources/security-tools/ike-scan) - VID database location and --showbackoff timing fingerprinting documentation
- [NTA Monitor: IKE Vendor IDs](https://www.nta-monitor.com/tools-resources/ike-vendor-ids) - Comprehensive list of known IKE vendor identification payloads with decoded product names