Information Gatheringikeipsecvpnfingerprintingdiscoverybackoffaggressivepsk

ike-scan

Discover and fingerprint IKE hosts (IPsec VPN Servers). Uses retransmission backoff pattern for implementation identification.

Description

ike-scan discovers IKE hosts and can also fingerprint them using the retransmission backoff pattern. It performs discovery by identifying hosts that respond to IKE requests and fingerprinting by analyzing response packet timing against known patterns.

The tool supports scanning IP addresses, hostnames, networks (192.168.1.0/24), and IP ranges. It works with both IKEv1 (Main and Aggressive modes) and experimental IKEv2 support. Additional features include PSK cracking support via psk-crack companion tool and various protocol manipulation options for testing VPN server responses.

Common use cases include network reconnaissance to identify IPsec VPN endpoints, vendor fingerprinting of IKE implementations, and aggressive mode PSK vulnerability assessment.

How It Works

ike-scan sends IKE request packets (UDP port 500 by default) to target hosts and analyzes responses for discovery. Fingerprinting uses UDP backoff pattern analysis - recording retransmission timeout intervals and matching against known vendor patterns in /usr/share/ike-scan/ike-backoff-patterns. Aggressive mode PSK cracking extracts parameters for offline dictionary/brute-force cracking with psk-crack using RFC 2409 SKEYID computation (MD5/SHA1) or Nortel proprietary method.

Installation

bash

sudo apt install ike-scan

Flags

--help or -hDisplay this usage message and exit.

--file=<fn> or -f <fn>Read hostnames or addresses from the specified file instead of from the command line. One name or IP address per line. Use "-" for standard input.

--sport= or -s Set UDP source port to , default=500, 0=random.

--dport= or -d Set UDP destination port to , default=500.

--retry=<n> or -r <n>Set total number of attempts per host to <n>, default=3.

--timeout=<n> or -t <n>Set initial per host timeout to <n> ms, default=500.

--bandwidth=<n> or -B <n>Set desired outbound bandwidth to <n>, default=56000 bits per second.

--interval=<n> or -i <n>Set minimum packet interval to <n> ms.

--backoff= or -b Set timeout backoff factor to , default=1.50.

--verbose or -vDisplay verbose progress messages. Use more than once for greater effect.

--showbackoff[=<n>] or -o[<n>]Display the backoff fingerprint table.

--aggressive or -AUse IKE Aggressive Mode (The default is Main Mode).

--pskcrack[=<f>] or -P[<f>]Crack aggressive mode pre-shared keys.

--nat-tUse RFC 3947 NAT-Traversal encapsulation.

--ikev2 or -2Use IKE version 2.

Examples

Display help and usage information

ike-scan -h

Scan entire network for IKE hosts

ike-scan 192.168.1.0/24

Scan IP range in Aggressive mode

ike-scan -A 192.168.1.3-192.168.1.27

Scan host and output PSK cracking parameters to file

ike-scan -P target.txt example.com

Display backoff fingerprint table for IKE implementation identification

ike-scan --showbackoff target-ip

Scan using NAT-T encapsulation on port 4500

ike-scan --nat-t --sport=4500 target

Scan hosts from file with verbose output

ike-scan --file=hosts.txt -v

Updated 2026-04-16kali.org ↗