Threat Level: green Handler on Duty: Didier Stevens

SANS ISC: Port 500 (tcp/udp) Attack Activity - SANS Internet Storm Center Port 500 (tcp/udp) Attack Activity

Sign Up for Free!   Forgot Password?
Log In or Sign Up for Free!
[get complete service list]
Port Information
Protocol Service Name
tcp isakmp VPN Key Exchange
udp isakmp VPN Key Exchange
Top IPs Scanning
TodayYesterday (35) (294) (17) (280) (16) (269) (15) (245) (15) (221) (15) (147) (12) (142) (11) (140) (10) (58) (10) (51)
Port diary mentions
Critical Cisco ASA IKEv1v2 Vulnerability. Active Scanning Detected
User Comments
Submitted By Date
PC.Tech 2016-02-13 01:42:50
Per: - 11 Feb 2016 - "... Note that Cisco ASA versions 7.2, 8.2, 8.3, and 8.6 are affected but no-longer-supported by the vendor. Users of these versions should strongly consider migrating to a supported solution..." //
2016-02-11 01:32:24
CVE-2016-1287 - Cisco ASA Software IKEv1 and IKEv2 Buffer Overflow Vulnerability For details see or
Javier Fernandez-Sanguino 2003-05-11 03:20:54
This port might be used by vulnerability CAN-2003-0108 (affects tcpdump) and CAN-2002-1103 (affects the Cisco VPN concentrator) There seems to be increasing scanning in this port (as described in which might be related to the release of a new tool (ike-scan, see
Add a comment
CVE Links
CVE # Description