Which tool discovers IKE hosts and can fingerprint them using the retransmission backoff pattern?

• A. rusers
• B. Svmap
• C. ike-scan
• D. DNSSEC Zone Walking

Answer: (C)

This question is about fingerprinting IKE endpoints by analyzing how they respond to negotiation retries. ike-scan is built for this purpose: it probes IKE services over UDP (usually port 500, or 4500 for NAT-T) and records the retransmission backoff pattern a target uses. Different IKE implementations and vendors respond with distinctive timing and retry behavior, so by examining these backoffs ike-scan can confirm that an IKE host is present and often infer the vendor or software stack. That makes it the best fit for discovering IKE hosts and fingerprinting them using the retransmission backoff pattern.

Other tools here don’t target this specific capability. rusers is for remote user enumeration, not IKE or negotiation timing. DNSSEC Zone Walking focuses on DNS data exposure, not IPsec IKE fingerprinting. svmap performs general service/version discovery, but it doesn’t specialize in interpreting IKE retransmission timing to fingerprint endpoints.