VPN Gateway Fingerprinting via IKE

Darshan Thummar@Mighty

•updated Jun 10, 2026•0•0•6

This rule detects potential VPN gateway fingerprinting attempts via the Internet Key Exchange (IKE) protocol. It triggers an alert when a source IP sends 5 or more UDP packets to port 500 (the standard IKE port) on the home network within a 30-second window. This behavior can indicate an attacker attempting to identify active VPN services or their configurations.