IKE-SCAN(1)

📦
version 1.9.5 · 2 versions
  • 1.9.5 · debian bookworm, debian trixie, nixos 26.05, nixpkgs unstable, ubuntu jammy, ubuntu noble, ubuntu questing, ubuntu resolute, ubuntu stonking (latest)
  • 1.9.4 · epel 9
, in debian bookworm, debian trixie, nixos 26.05, nixpkgs unstable, ubuntu jammy, ubuntu noble, ubuntu questing, ubuntu resolute, ubuntu stonking

💖 ike-scan(1) — General Commands Manual 💖

okay bestie, welcome to the manual page for ike-scan(1), like from the General Commands Manual. It's giving network discovery, it's giving fingerprinting, it's giving IPsec VPN server energy. Let's get into it. ✨

✨ NAME ✨

ike-scan — discover and fingerprint IKE hosts (aka IPsec VPN servers). No cap. 👑

🌸 SYNOPSIS 🌸

ike-scan [options] [hosts...]

Target hosts must be specified on the command line unless the --file option is specified. Like, you gotta tell it where to look, bestie. Unless you use the file thing. 💅

🦋 DESCRIPTION 🦋

ike-scan discovers IKE hosts and can also fingerprint them using the retransmission backoff pattern. So it's a whole detective vibe. 🔍

Here's the tea: ike-scan does two things:

  1. Discovery — Figure out which hosts are running IKE. It does this by displaying the hosts that respond to the IKE requests sent by ike-scan. Basically, "hey, are you there?" and if they answer, they're on the list. 💖
  2. Fingerprinting — Figure out which IKE implementation the hosts are using. There are a few ways to do this:
    • (a) Backoff fingerprinting — recording the times of the IKE response packets from the target hosts and comparing the observed retransmission backoff pattern against known patterns.
    • (b) Vendor ID fingerprinting — matching the vendor-specific vendor IDs against known vendor ID patterns.
    • (c) Proprietary notify message codes.

The retransmission backoff fingerprinting concept is discussed in more detail in the UDP backoff fingerprinting paper, which should be included in the ike-scan kit as udp-backoff-fingerprinting-paper.txt. So if you're a nerd (affectionate), go read that. 📄

The program sends IKE Phase-1 requests to the specified hosts and displays any responses that are received. It handles retry and retransmission with backoff to cope with packet loss. It also limits the amount of bandwidth used by the outbound IKE packets. So it's polite about it. ✨

IKE is the Internet Key Exchange protocol, which is the key exchange and authentication mechanism used by IPsec. Just about all modern VPN systems implement IPsec, and the vast majority of IPsec VPNs use IKE for key exchange. So yeah, it's kind of a big deal. 💅

Phase-1 has two modes: Main Mode and Aggressive Mode. ike-scan supports both Main and Aggressive mode, and uses Main Mode by default. RFC 2409 (IKE) section 5 specifies that main mode must be implemented, therefore all IKE implementations can be expected to support main mode. So main mode is the safe bet, bestie. 👑

💅 OPTIONS 💅

Okay, now the good stuff. Every flag, every option, every little detail. Let's go. 🏃‍♀️

  • --help, -h — Display this usage message and exit. Like a little "hey here's how to use me" and then it dips. 👋
  • --file=<fn>, -f <fn> — Read hostnames or addresses from the specified file instead of from the command line. One name or IP address per line. Use - for standard input. So you can pipe it in, bestie. 💖
  • --sport=<p>, -s <p> — Set UDP source port to <p>, default=500, 0=random. Some IKE implementations require the client to use UDP source port 500 and will not talk to other ports. Note that superuser privileges are normally required to use non-zero source ports below 1024. Also only one process on a system may bind to a given source port at any one time. Use of the --nat-t option changes the default source port to 4500. So yeah, port drama. 🎀
  • --dport=<p>, -d <p> — Set UDP destination port to <p>, default=500. UDP port 500 is the assigned port number for ISAKMP and this is the port used by most if not all IKE implementations. Use of the --nat-t option changes the default destination port to 4500. So 500 is the classic, 4500 is the NAT-T era. 💅
  • --retry=<n>, -r <n> — Set total number of attempts per host to <n>, default=3. Three strikes and you're out, but like, for packets. 🙈
  • --timeout=<n>, -t <n> — Set initial per host timeout to <n> ms, default=500. This timeout is for the first packet sent to each host. Subsequent timeouts are multiplied by the backoff factor which is set with --backoff. So it starts at 500ms and then grows. ⏳
  • --bandwidth=<n>, -B <n> — Set desired outbound bandwidth to <n>, default=56000. The value is in bits per second by default. If you append K to the value, then the units are kilobits per second; and if you append M to the value, then the units are megabits per second. The K and M suffixes represent the decimal, not binary, multiples. So 64K is 64000, not 65536. Important distinction, bestie. Don't get it twisted. 📶
  • --interval=<n>, -i <n> — Set minimum packet interval to <n> ms. The packet interval will be no smaller than this number. The interval specified is in milliseconds by default. If u is appended to the value, then the interval is in microseconds, and if s is appended, the interval is in seconds. If you want to use up to a given bandwidth, then it is easier to use the --bandwidth option instead. You cannot specify both --interval and --bandwidth because they are just different ways to change the same underlying variable. So pick one, okay? 💖
  • --backoff=<b>, -b <b> — Set timeout backoff factor to <b>, default=1.50. The per-host timeout is multiplied by this factor after each timeout. So, if the number of retries is 3, the initial per-host timeout is 500ms and the backoff factor is 1.5, then the first timeout will be 500ms, the second 750ms and the third 1125ms. Math is giving exponential realness. 🔢
  • --verbose, -v — Display verbose progress messages. Use more than once for greater effect:
    • 1 — Show when each pass is completed and when packets with invalid cookies are received.
    • 2 — Show each packet sent and received and when hosts are removed from the list.
    • 3 — Display the host, Vendor ID and backoff lists before scanning starts. So you can go from "a little chatty" to "literally narrating everything". 🗣️
  • --quiet, -q — Don't decode the returned packet. This prints less protocol information so the output lines are shorter. Sometimes you just want the vibe without the lore. 🤫
  • --multiline, -M — Split the payload decode across multiple lines. With this option, the decode for each payload is printed on a separate line starting with a TAB. This option makes the output easier to read, especially when there are many payloads. So it's giving organized. 📋
  • --lifetime=<s>, -l <s> — Set IKE lifetime to <s> seconds, default=28800. RFC 2407 specifies 28800 as the default, but some implementations may require different values. If you specify this as a decimal integer, e.g. 86400, then the attribute will use a 4-byte value. If you specify it as a hex number, e.g. 0xFF, then the attribute will use the appropriate size value (one byte for this example). If you specify the string "none" then no lifetime attribute will be added at all. You can use this option more than once in conjunction with the --trans options to produce multiple transform payloads with different lifetimes. Each --trans option will use the previously specified lifetime value. So many ways to say how long. ⏰
  • --lifesize=<s>, -z <s> — Set IKE lifesize to <s> Kilobytes, default=0. If you specify this as a decimal integer, e.g. 86400, then the attribute will use a 4-byte value. If you specify it as a hex number, e.g. 0xFF, then the attribute will use the appropriate size value (one byte for this example). You can use this option more than once in conjunction with the --trans options to produce multiple transform payloads with different lifesizes. Each --trans option will use the previously specified lifesize value. Size matters, bestie. 📏
  • --auth=<n>, -m <n> — Set auth. method to <n>, default=1 (PSK). RFC defined values are 1 to 5. See RFC 2409 Appendix A. Checkpoint hybrid mode is 64221. GSS (Windows "Kerberos") is 65001. XAUTH uses 65001 to 65010. This is not applicable to IKEv2. So auth methods, but only for classic IKE, not the v2 girlies. 🔐
  • --version, -V — Display program version and exit. Just a quick "who am I" and then bounce. 👑
  • --vendor=<v>, -e <v> — Set vendor id string to hex value <v>. You can use this option more than once to send multiple vendor ID payloads. Flex those vendor IDs. 💅
  • --trans=<t>, -a <t> — Use custom transform <t> instead of default set. You can use this option more than once to send an arbitrary number of custom transforms. There are two ways to specify the transform: The new way, where you specify the attribute/value pairs, and the old way where you specify the values for a fixed list of attributes. For the new method, the transform <t> is specified as (attr=value, attr=value, ...) where attr is the attribute number, and value is the value to assign to that attribute. You can specify an arbitrary number of attribute/value pairs. See RFC 2409 Appendix A for details of the attributes and values. Note that brackets are special to some shells, so you may need to quote them, e.g. --trans="(1=1,2=2,3=3,4=4)". For example, --trans=(1=1,2=2,3=1,4=2) specifies Enc=3DES-CBC, Hash=SHA1, Auth=shared key, DH Group=2; and --trans=(1=7,14=128,2=1,3=3,4=5) specifies Enc=AES/128, Hash=MD5, Auth=RSA sig, DH Group=5. For the old method, the transform <t> is specified as enc[/len],hash,auth,group. Where enc is the encryption algorithm, len is the key length for variable length ciphers, hash is the hash algorithm, and group is the DH Group. For example, --trans=5,2,1,2 specifies Enc=3DES-CBC, Hash=SHA1, Auth=shared key, DH Group=2; and --trans=7/256,1,1,5 specifies Enc=AES-256, Hash=MD5, Auth=shared key, DH Group=5. This option is not yet supported for IKEv2. So transforms, but not for v2 yet. 🔄
  • --showbackoff[=<n>], -o[<n>] — Display the backoff fingerprint table. Display the backoff table to fingerprint the IKE implementation on the remote hosts. The optional argument specifies time to wait in seconds after receiving the last packet, default=60. If you are using the short form of the option (-o) then the value must immediately follow the option letter with no spaces, e.g. -o25 not -o 25. So no space, bestie, or it won't work. 🕰️
  • --fuzz=<n>, -u <n> — Set pattern matching fuzz to <n> ms, default=500. This sets the maximum acceptable difference between the observed backoff times and the reference times in the backoff patterns file. Larger values allow for higher variance but also increase the risk of false positive identifications. Any per-pattern-entry fuzz specifications in the patterns file will override the value set here. So fuzz is like a tolerance level. Don't set it too high or you'll get catfished by false positives. 🙈
  • --patterns=<f>, -p <f> — Use IKE backoff patterns file <f>, default=/usr/local/share/ike-scan/ike-backoff-patterns. This specifies the name of the file containing IKE backoff patterns. This file is only used when --showbackoff is specified. So it's the reference book for backoff vibes. 📚
  • --vidpatterns=<f>, -I <f> — Use Vendor ID patterns file <f>, default=/usr/local/share/ike-scan/ike-vendor-ids. This specifies the name of the file containing Vendor ID patterns. These patterns are used for Vendor ID fingerprinting. So this is the vendor ID lookup table. 🏷️
  • --aggressive, -A — bestie, this flips you into IKE Aggressive Mode (the default is Main Mode, jsyk 👀). If you go --aggressive, you're also allowed to bring --dhgroup, --id and --idtype along for the ride. And if you're doing custom transforms in aggressive mode with --trans, heads up: all transforms should have the same DH Group, and that group has to match whatever you set with --dhgroup — or the default, if you didn't touch --dhgroup at all. 💅
  • --id=<id>, -n <id> — uses <id> as the identification value. ⚠️ This one is only applicable to Aggressive Mode, no exceptions. You can hand it a string, like --id=test, or a hex value with a leading "0x", like --id=0xdeadbeef. Slay.
  • --idtype=<n>, -y <n> — sets the identification type to <n>. Default is 3 (ID_USER_FQDN). Again, only applicable to Aggressive Mode. If you want the full rundown of Identification types, go read RFC 2407 4.6.2. 📖
  • --dhgroup=<n>, -g <n> — picks Diffie Hellman Group <n>. Default is 2. This one is only applicable to Aggressive Mode and IKEv2 — and for both of those, it's what determines the size of the key exchange payload. Now listen: if you're running Aggressive Mode with custom transforms, you'll normally need to use --dhgroup unless you're vibing with the default DH group. Acceptable values are 1,2,5,14,15,16,17,18 (MODP only, no cap).
  • --gssid=<n>, -G <n> — sets the GSS ID to <n>, where <n> is a hex string. This uses transform attribute type 16384 as specified in draft-ietf-ipsec-isakmp-gss-auth-07.txt, although Windows-2000 has been observed to use 32001 as well. 🙈 For Windows 2000, you'll need to use --auth=65001 to specify Kerberos (GSS) authentication.
  • --random, -R — randomises the host list ✨. It shuffles the order of the hosts in the host list, so your IKE probes get sent out in a random order. It uses the Knuth shuffle algorithm, which is iconic honestly.
  • --tcp[=<n>], -T[<n>] — use TCP transport instead of UDP. This lets you test a host running IKE over TCP. Ngl you won't normally need this, because the vast majority of IPsec systems only support IKE over UDP. The optional value <n> picks the type of IKE over TCP, and there are currently two possible values: 1 = RAW IKE over TCP as used by Checkpoint (the default); 2 = Encapsulated IKE over TCP as used by Cisco. If you're using the short form (-T), the value must immediately follow the option letter with no spaces — like -T2, not -T 2. And you can only specify a single target host if you use this option. 🎯
  • --tcptimeout=<n>, -O <n> — sets the TCP connect timeout to <n> seconds (default=10). Only applicable to TCP transport mode, bestie.
  • --pskcrack[=<f>], -P[<f>] — crack aggressive mode pre-shared keys 😈. This outputs the aggressive mode pre-shared key (PSK) parameters for offline cracking using the "psk-crack" program that ships with ike-scan. You can optionally pass a filename, <f>, to write the PSK parameters to. If you don't give a filename, the PSK parameters go to standard output. If you're using the short form (-P), the value must immediately follow the option letter with no spaces — -Pfile, not -P file. You can only specify a single target host here too, and it's only applicable to IKE aggressive mode. 🍓
  • --nodns, -N — do not use DNS to resolve names. If you use this, then every single host must be specified as an IP address. Periodt.
  • --noncelen=<n>, -c <n> — sets the nonce length to <n> bytes. Default=20. This controls the length of the nonce payload that gets sent in an aggressive mode or IKEv2 request. Normally there's no need to touch this unless you wanna shrink the nonce size to speed up pre-shared key cracking, or you just wanna see how a particular server handles different-length nonce payloads. RFC 2409 says the length of the nonce payload must be between 8 and 256 bytes, but ike-scan does not enforce this 👀. Specifying a large nonce length will increase the size of the packet ike-scan sends, and a very large nonce length may cause fragmentation, or even exceed the maximum IP packet size. 💀 This option is only applicable to IKE aggressive mode.
  • --headerlen=<n>, -L <n> — sets the length in the ISAKMP header to <n> bytes. You can use this to manually specify the value used for the ISAKMP header length. By default, ike-scan fills in the correct value — so this option is for when you wanna manually specify an incorrect length. 😭 <n> can be given as "+n", which sets the length to n bytes more than it should be; "-n", which sets it to n bytes less; or "n", which sets it to exactly that many bytes. > Changing the header length to an incorrect value can sometimes disrupt VPN servers.
  • --mbz=<n>, -Z <n> — uses the value <n> for reserved (MBZ) fields, default=0. > Specifying this option makes the outgoing packet non-RFC compliant, so only use it if you wanna see how a VPN server responds to invalid packets. The value of <n> should be in the range 0-255.
  • --headerver=<n>, -E <n> — specify the ISAKMP header version. The default is 0x10 (16), which corresponds to v1.0. > Specifying a non-default value makes the outgoing packet non-RFC compliant, so again, only use it if you wanna see how the VPN server reacts to strange versions. The value should be in the range 0-255.
  • --certreq=<c>, -C <c> — adds the CertificateRequest payload <c>. <c> should be specified as a hex value. The first byte of that hex value gets interpreted as the certificate type, and the remaining bytes as the certificate authority, as described in RFC 2408 3.10. The certificate types are listed in RFC 2408 sec 3.9. And RFC 2408 states "The Certificate Request payload MUST be accepted at any point during the exchange" — so like, respect it. 🫶
  • --doi=<d>, -D <d> — sets the SA DOI to <d>, default 1 (IPsec). You won't normally wanna change this unless you're curious how the VPN server responds to a non-standard DOI. 🦋
  • --situation=<s>, -S <s> — sets the SA Situation to <d>, default 1. The meaning of the situation depends on the DOI and is detailed in the appropriate DOI document. For the IPsec DOI, the default Situation of 1 represents SIT_IDENTITY_ONLY. You won't normally wanna change this unless you wanna see how the VPN server responds to a non-standard situation.
  • --protocol=<p>, -j <p> — sets the Proposal protocol ID to <p>, default 1. The meaning of the proposal protocol ID depends on the DOI and is detailed in the appropriate DOI document. For the IPsec DOI, the default proposal protocol id of 1 represents PROTO_ISAKMP. You won't normally wanna change this unless you wanna see how the VPN server responds to a non-standard protocol ID.
  • --transid=<t>, -k <t> — sets the Transform ID to <t>, default 1. The meaning of the transform ID depends on the DOI and is detailed in the appropriate DOI document. For the IPsec DOI, the default transform id of 1 represents KEY_IKE. You won't normally wanna change this unless you wanna see how the VPN server responds to a non-standard transform ID.
  • --spisize=<n> — sets the proposal SPI size to <n>. Default=0. If this is non-zero, then a random SPI of the specified size gets added to the proposal payload. The default of zero means no SPI. 💅
  • --hdrflags=<n> — sets the ISAKMP header flags to <n>. Default=0. The flags are detailed in RFC 2408 section 3.1.
  • --hdrmsgid=<n> — sets the ISAKMP header message ID to <n>. Default=0. This should be zero for IKE Phase-1, bestie.
  • --cookie=<n> — sets the ISAKMP initiator cookie to <n>. The cookie value should be specified in hex. By default, the cookies are automatically generated and have unique values ✨. > If you specify this option, then you can only specify a single target, because ike-scan requires unique cookie values to match up the response packets. So pick your fighter. 🎀
  • --exchange=<n> — sets the exchange type to <n>. This lets you change the exchange type in the ISAKMP header to an arbitrary value. Note that ike-scan only supports Main and Aggressive modes (values 2 and 4 respectively). Specifying other values will change the exchange type value in the ISAKMP header, but will not adjust the other payloads. 😭 The exchange types are defined in RFC 2408 sec 3.1.
  • --nextpayload=<n> — sets the next payload in the ISAKMP header to <n>. Normally, the next payload is automatically set to the correct value, so like... you do you. 🙈
  • --randomseed=<n> — uses <n> to seed the pseudo random number generator. This seeds the PRNG with the specified number, which is lowkey useful if you want to ensure that the packet data is exactly repeatable when it includes payloads with random data such as key exchange or nonce. By default, the PRNG is seeded with an unpredictable value.
  • --timestamp — displays timestamps for received packets. This causes a timestamp to be displayed for each received packet. ⭐
  • --sourceip=<s> — sets the source IP address for outgoing packets to <s>. This makes the outgoing IKE packets carry the specified source IP address. The address can either be an IP address in dotted quad format, or the string "random", which will use a different random source address for each packet that's sent. > If this option is used, no packets will be received. This option requires raw socket support, and you'll need superuser privileges to use it — even if you specify a high source port. Also, it does not work on all operating systems. 💀
  • --shownum — displays the host number for received packets. This shows the ordinal host number of the responding host before the IP address. It can be useful when you're sending many packets to the same target IP, so you can see if any probes are being ignored. 👑
  • --nat-t — ok so this one wraps your packets in RFC 3947 NAT-Traversal encapsulation 💫. It slaps the non-ESP marker onto the front of every outgoing packet and peels it off the received ones, exactly like RFC 3947 says. It also flips the default source port to 4500 and the default destination port to 4500, because those are the NAT-T IKE ports, periodt. Wanna change those ports anyway? Go off — --sport and --dport can do it, but only if you use them after --nat-t. Order matters bestie, no cap. 🔥
  • --rcookie=<n> — sets the ISAKMP responder cookie to <n>, i.e. whatever hex value you hand it. Default is just zero. So if you're feeling extra, <n> is your moment. 🍓
  • --ikev2, -2 — use IKE version 2 ✨. Outgoing packets get the IKEv2 format from RFC 4306 instead of the default IKEv1 format. And the return packets? Those get auto-decoded as IKE or IKEv2 based on their payloads, no matter what you picked here — it's giving main character energy, honestly.
⚠️ Heads up bestie: --ikev2 is currently experimental. It has not been extensively tested, and it only supports sending the default proposal. So like… use it, love it, but know what you're doing. 💀

📁 FILES 📁

  • /usr/local/share/ike-scan/ike-backoff-patterns — the list of UDP backoff patterns, used whenever you pass --showbackoff. 🦋
  • /usr/local/share/ike-scan/ike-vendor-ids — the list of known Vendor ID patterns. 💜

👑 AUTHOR 👑

Roy Hills <Roy.Hills@nta-monitor.com>

👀 SEE ALSO 👀

and that's a wrap on the whole page, bestie 🫶 this was IKE-SCAN(1) from July 5, 2020 — yes, the source/version line and the date, all of it, mentioned right here because I love you. now go scan some IKE and slay. 💅✨

📦 where this page comes from