local table = require 'table' --[[ Author: Jesper Kückelhahn 2012 This is compiled list of known IKE vendor IDs. Most of the VIDs have been copied from ike-scan with permission from the original author, Roy Hills, so a big 'thank you' is in order. -- http://www.nta-monitor.com/wiki/index.php/Ike-scan_Documentation The file has three main components: fingerprints attributes ordering - 'Fingerprint' includes VIDs that can be directly linked to specific vendors - 'Attributes' include VIDs that are general, but some vendor guess might be possible - 'Ordering' includes a collection of VIDs and the ordering in which they are returned from the service. This can allow for OS detection in some cases; currently only Cisco devices are include. This is based on the results of: http://www.nta-monitor.com/wiki/index.php/IKE_Implementation_Analysis ]] --[[ Unknown ids: ab926d9ee113a0219557fcc54e52865c 625027749d5ab97f5616c1602765cf480a3b7d0b ]] author = "Jesper Kueckelhahn" license = "Simplified (2-clause) BSD license--See http://nmap.org/svn/docs/licenses/BSD-simplified" fingerprints = {}; -------------------------------------------------------------------------------- -------------------------------------------------------------------------------- -- Vendor ID Fingerprints -------------------------------------------------------------------------------- -------------------------------------------------------------------------------- -------------------------------------------------------------------------------- -- Avaya -------------------------------------------------------------------------------- table.insert(fingerprints, { category = 'fingerprint', vendor = 'Avaya', version = 'VPN', vids = { [''] = '^4485152d18b6bbcc0be8a8469579ddcc' } }); -------------------------------------------------------------------------------- -- Checkpoint Firewall-1 -------------------------------------------------------------------------------- table.insert(fingerprints,{ category = 'fingerprint', vendor = 'Checkpoint', version = 'Firewall-1', vids = { ['4.1 Base'] = '^f4ed19e0c114eb516faaac0ee37daf2807b4381f00000001000000020000000000000000........', ['4.1 SP1'] = '^f4ed19e0c114eb516faaac0ee37daf2807b4381f00000001000000030000000000000000........', ['4.1 SP2-SP6'] = '^f4ed19e0c114eb516faaac0ee37daf2807b4381f0000000100000fa20000000000000000........', ['NG Base'] = '^f4ed19e0c114eb516faaac0ee37daf2807b4381f00000001000013880000000000000000........', ['NG FP1'] = '^f4ed19e0c114eb516faaac0ee37daf2807b4381f00000001000013890000000000000000........', ['NG FP2'] = '^f4ed19e0c114eb516faaac0ee37daf2807b4381f000000010000138a0000000000000000........', ['NG FP3'] = '^f4ed19e0c114eb516faaac0ee37daf2807b4381f000000010000138b0000000000000000........', ['NG AI R54'] = '^f4ed19e0c114eb516faaac0ee37daf2807b4381f000000010000138c0000000000000000........', ['NG AI R55'] = '^f4ed19e0c114eb516faaac0ee37daf2807b4381f000000010000138d0000000000000000........', } }); table.insert(fingerprints,{ category = 'fingerprint', vendor = 'Checkpoint', version = 'Firewall-1', vids = { ['NGX'] = '^f4ed19e0c114eb516faaac0ee37daf2807b4381f000000010000138d........00000000........', } }); table.insert(fingerprints,{ category = 'fingerprint', vendor = 'Checkpoint', version = 'Firewall-1', vids = { [''] = '^f4ed19e0c114eb516faaac0ee37daf2807b4381f' } }); -------------------------------------------------------------------------------- -- Cisco -------------------------------------------------------------------------------- table.insert(fingerprints, { category = 'fingerprint', vendor = 'Cisco', version = 'VPN 3000 series Concentrator', vids = { ['version 3.0.0'] = '^1f07f70eaa6514d3b0fa96542a500300', ['version 3.0.1'] = '^1f07f70eaa6514d3b0fa96542a500301', ['version 3.0.5'] = '^1f07f70eaa6514d3b0fa96542a500305', ['version 4.0.7'] = '^1f07f70eaa6514d3b0fa96542a500407', -- ['VPN 3000 Concentrator (client)'] = '^f6f7efc7f5aeb8cb158cb9d094ba69e7', } }); table.insert(fingerprints, { category = 'fingerprint', vendor = 'Cisco', version = '', vids = { [''] = '^1f07f70eaa6514d3b0fa96542a......', } }); table.insert(fingerprints, { category = 'fingerprint', vendor = 'Cisco', version = 'IOS Device', vids = { [''] = '^3e984048', } }); -------------------------------------------------------------------------------- -- Fortinet -------------------------------------------------------------------------------- table.insert(fingerprints, { category = 'fingerprint', vendor = 'Fortinet', version = 'FortiGate', vids = { [''] = '^1d6e178f6c2c0be284985465450fe9d4' } }); -------------------------------------------------------------------------------- -- FreeS/WAN -------------------------------------------------------------------------------- table.insert(fingerprints, { category = 'fingerprint', vendor = 'Linux FreeS/WAN', version = 'VPN', vids = { ['2.00'] = '^4f45486b7d44784d42676b5d', ['2.01'] = '^4f457c4f547e6e615b426e56', ['2.02'] = '^4f456c6b44696d7f6b4c4e60', ['2.03'] = '^4f45566671474962734e6264', ['2.04'] = '^4f45704f736579505c6e5f6d', ['2.05'] = '^4f457271785f4c7e496f4d54', ['2.06'] = '^4f457e4c466e5d427c5c6b52' } }); -------------------------------------------------------------------------------- -- Juniper -------------------------------------------------------------------------------- table.insert(fingerprints, { category = 'fingerprint', vendor = 'Juniper', version = 'NetScreen', vids = { ['SSG-550M v6.20'] = '^2c9d7e81995b9967d23f571ac641f9348122f1cc1200000014060000', -- (source:http://kb.juniper.net/InfoCenter/index?page=content&id=KB22222&cat=FIREWALL_IPSEC_VPN&actp=LIST) ['ns5gt (1)'] = '^166f932d55eb64d8e4df4fd37e2313f0d0fd8451', ['ns5gt (2)'] = '^4a4340b543e02b84c88a8b96a8af9ebe77d9accc', ['ns5xp (1)'] = '^299ee8289f40a8973bc78687e2e7226b532c3b76', ['ns5xp (2)'] = '^64405f46f03b7660a23be116a1975058e69e8387', ['02'] = '^3a15e1f3cf2a63582e3ac82d1c64cbe3b6d779e7', ['03'] = '^47d2b126bfcd83489760e2cf8c5d4d5a03497c15', ['06'] = '^699369228741c6d4ca094c93e242c9de19e7b7c6', ['07'] = '^8c0dc6cf62a0ef1b5c6eabd1b67ba69866adf16a', ['08'] = '^92d27a9ecb31d99246986d3453d0c3d57a222a61', ['09'] = '^9b096d9ac3275a7d6fe8b91c583111b09efed1a0', ['10'] = '^bf03746108d746c904f1f3547de24f78479fed12', ['11'] = '^c2e80500f4cc5fbf5daaeed3bb59abaeee56c652', ['12'] = '^c8660a62b03b1b6130bf781608d32a6a8d0fb89f', ['13'] = '^f885da40b1e7a9abd17655ec5bbec0f21f0ed52e', ['14'] = '^2a2bcac19b8e91b426107807e02e7249569d6fd3', ['16'] = '^a35bfd05ca1ac0b3d2f24e9e82bfcbff9c9e52b5', ['17'] = '^9436e8d67174ef9aed068d5ad5213f187a3f8ba6', } }); -------------------------------------------------------------------------------- -- KAME/racoon -------------------------------------------------------------------------------- table.insert(fingerprints, { category = 'fingerprint', vendor = 'KAME/racoon', version = 'VPN', vids = { [''] = '^7003cbc1097dbe9c2600ba6983bc8b35' } }); -------------------------------------------------------------------------------- -- Mac OS X -------------------------------------------------------------------------------- table.insert(fingerprints, { category = 'fingerprint', vendor = 'Apple', version = 'Mac OS X', vids = { ['(1)'] = '^4d6163204f53582031302e78', ['(2)'] = '^4df37928e9fc4fd1b3262170d515c662' } }); -------------------------------------------------------------------------------- -- Microsoft -- http://msdn.microsoft.com/en-us/library/cc233476.aspx -------------------------------------------------------------------------------- table.insert(fingerprints, { category = 'fingerprint', vendor = 'Microsoft', version = 'Windows', vids = { ['2000'] = '^1e2b516905991c7d7c96fcbfb587e46100000002', ['XP'] = '^1e2b516905991c7d7c96fcbfb587e46100000003', ['2003'] = '^1e2b516905991c7d7c96fcbfb587e46100000004', ['Vista'] = '^1e2b516905991c7d7c96fcbfb587e46100000005', ['Server 2008'] = '^1e2b516905991c7d7c96fcbfb587e46100000006', ['7'] = '^1e2b516905991c7d7c96fcbfb587e46100000007', ['Server 2008 R2'] = '^1e2b516905991c7d7c96fcbfb587e46100000008', ['8'] = '^1e2b516905991c7d7c96fcbfb587e46100000009', ['Server 2012'] = '^1e2b516905991c7d7c96fcbfb587e46100000010', } }); table.insert(fingerprints, { category = 'fingerprint', vendor = 'Microsoft', version = 'Windows', vids = { [''] = '^1e2b516905991c7d7c96fcbfb587e46.........', } }); -------------------------------------------------------------------------------- -- Nortel Contivity -- The last byte might be a version ? -------------------------------------------------------------------------------- table.insert(fingerprints, { category = 'fingerprint', vendor = 'Nortel', version = 'Contivity', vids = { [''] = '^424e4553000000..' } }); -------------------------------------------------------------------------------- -- OpenPGP -------------------------------------------------------------------------------- table.insert(fingerprints, { category = 'fingerprint', vendor = 'OpenPGP', version = '', vids = { [''] = '^4f70656e504750' } }); -------------------------------------------------------------------------------- -- Openswan -------------------------------------------------------------------------------- table.insert(fingerprints, { category = 'fingerprint', vendor = 'Openswan', version = 'VPN', vids = { ['2.2.0'] = '^4f4548724b6e5e68557c604f', ['2.3.0'] = '^4f4572696f5c77557f746249', } }); -------------------------------------------------------------------------------- -- SafeNet -------------------------------------------------------------------------------- table.insert(fingerprints, { category = 'fingerprint', vendor = 'SafeNet', version = 'SoftRemote', vids = { ['8.0.0'] = '^47bbe7c993f1fc13b4e6d0db565c68e5010201010201010310382e302e3020284275696c6420313029000000', ['9.0.1'] = '^47bbe7c993f1fc13b4e6d0db565c68e5010201010201010310392e302e3120284275696c6420313229000000', } }); table.insert(fingerprints, { category = 'fingerprint', vendor = 'SafeNet', version = 'SoftRemote', vids = { [''] = '^47bbe7c993f1fc13b4e6d0db565c68e5' } }); -------------------------------------------------------------------------------- -- SonicWall -------------------------------------------------------------------------------- table.insert(fingerprints, { category = 'fingerprint', vendor = 'SonicWall', version = 'VPN', vids = { ['(1)'] = '^5b362bc820f60001', -- SonicWall 3060 ? ['(3)'] = '^5b362bc820f60003', ['(6)'] = '^5b362bc820f60006', ['(7)'] = '^5b362bc820f60007', -- (Maybe NSA?, SonicOS Enhanced 4.2?) ['(a)'] = '^404bf439522ca3f6', ['(b)'] = '^da8e937880010000', -- (Maybe TZ 170) } }); -------------------------------------------------------------------------------- -- SSH IPSec Express -------------------------------------------------------------------------------- table.insert(fingerprints, { category = 'fingerprint', vendor = 'SSH IPSec', version = 'Express', vids = { ['1.1.0'] = '^fbf47614984031fa8e3bb6198089b223', ['1.1.1'] = '^1952dc91ac20f646fb01cf42a33aee30', ['1.1.2'] = '^e8bffa643e5c8f2cd10fda7370b6ebe5', ['1.2.1'] = '^c1111b2dee8cbc3d620573ec57aab9cb', ['1.2.2'] = '^09ec27bfbc09c75823cfecbffe565a2e', ['2.0.0'] = '^7f21a596e4e318f0b2f4944c2384cb84', ['2.1.0'] = '^2836d1fd2807bc9e5ae30786320451ec', ['2.1.1'] = '^a68de756a9c5229bae66498040951ad5', ['2.1.2'] = '^3f2372867e237c1cd8250a75559cae20', ['3.0.0'] = '^0e58d5774df602007d0b02443660f7eb', ['3.0.1'] = '^f5ce31ebc210f44350cf71265b57380f', ['4.0.0'] = '^f64260af2e2742daddd56987068a99a0', ['4.0.1'] = '^7a54d3bdb3b1e6d923892064be2d981c', ['4.1.0'] = '^9aa1f3b43472a45d5f506aeb260cf214', ['4.1.1'] = '^89f7b760d86b012acf263382394d962f', ['4.2.0'] = '^6880c7d026099114e486c55430e7abee', ['5.0'] = '^b037a21aceccb5570f602546f97bde8c', ['5.0.0'] = '^2b2dad97c4d140930053287f996850b0', ['5.1.0'] = '^45e17f3abe93944cb202910c59ef806b', ['5.1.1'] = '^5925859f7377ed7816d2fb81c01fa551' } }); -------------------------------------------------------------------------------- -- SSH QuickSec -------------------------------------------------------------------------------- table.insert(fingerprints, { category = 'fingerprint', vendor = 'SSH QuickSec', version = 'VPN', vids = { ['0.9.0'] = '^37eba0c4136184e7daf8562a77060b4a', ['1.1.0'] = '^5d72925e55948a9661a7fc48fdec7ff9', ['1.1.1'] = '^777fbf4c5af6d1cdd4b895a05bf82594', ['1.1.2'] = '^2cdf08e712ede8a5978761267cd19b91', ['1.1.3'] = '^59e454a8c2cf02a34959121f1890bc87', ['2.1.0'] = '^8f9cc94e01248ecdf147594c284b213b', } }); -------------------------------------------------------------------------------- -- SSH Sentinel -------------------------------------------------------------------------------- table.insert(fingerprints, { category = 'fingerprint', vendor = 'SSH Sentinel', version = '', vids = { [''] = '^054182a07c7ae206f9d2cf9d2432c482', ['1.1'] = '^b91623e693ca18a54c6a2778552305e8', ['1.2'] = '^5430888de01a31a6fa8f60224e449958', ['1.3'] = '^7ee5cb85f71ce259c94a5c731ee4e752', ['1.4'] = '^63d9a1a7009491b5a0a6fdeb2a8284f0', ['1.4.1'] = '^eb4b0d96276b4e220ad16221a7b2a5e6' } }); -------------------------------------------------------------------------------- -- Stonegate -------------------------------------------------------------------------------- table.insert(fingerprints, { category = 'fingerprint', vendor = 'StoneGate', version = 'VPN', vids = { ['(1)'] = '^c573b056d7faca36c2fba28374127cbf', ['(2)'] = '^baeb239037e17787d730eed9d95d48aa' } }); -------------------------------------------------------------------------------- -- strongSwan -------------------------------------------------------------------------------- table.insert(fingerprints, { category = 'fingerprint', vendor = 'strongSwan', version = 'VPN', vids = { ['4.3.6'] = '^882fe56d6fd20dbc2251613b2ebe5beb', ['4.2.3'] = '^2d1f406118fbd5d28474791ffa00488a', ['4.2.2'] = '^2a517d0d23c37d08bce7c292a0217b39', ['4.2.1'] = '^bab253f4cb10a8108a7c927c56c87886', ['4.2.0'] = '^9f68901325a972894335302a9531ab9f', ['4.1.11'] = '^b7bd9f2f978e3259a7aa9f7a1396ad6c', ['4.1.10'] = '^bf3a89ae5bef8e72d44dac8bb88d7d5f', ['4.1.9'] = '^78fdd287def01a3f074b5369eab4fd1c', ['4.1.8'] = '^66a2045507c119da78a4666259cdea48', ['4.1.7'] = '^ea840aa4dfc9712d6c32b5a16eb329a3', ['4.1.6'] = '^d19683368af4b0edc21ccde982b1d1b0', ['4.1.5'] = '^bf0fbf7306ebb7827042d893539886e2', ['4.1.4'] = '^312f9cb1a6b90e19de7528c904ac3087', ['4.1.3'] = '^5849ab6d8beabd6e4d09e5a3b88c089a', ['4.1.2'] = '^15a1ace7ee52fddfef04f928db2dd134', ['4.1.1'] = '^d3f1c488c368175d5f40a8f5ca5f5e12', ['4.1.0'] = '^4794cef6843422980d1a3d06af41c5cd', ['4.0.7'] = '^ab0746221cc8fd0d5238f73a9b3da557', ['4.0.6'] = '^4c90136946577b51919d8d9a6b8e4a9f', ['4.0.5'] = '^dd180d21e5ce655a768ba32211dd8ad9', ['4.0.4'] = '^1ef283f83549b5ff9608b6d634f84d75', ['4.0.3'] = '^b181b18e114fc209b3c6e26c3a80718e', ['4.0.2'] = '^77e8eea6f556a499de3ffe7f7f95661c', ['4.0.1'] = '^9dbbafcf1db0dd595ae065294003ad3e', ['4.0.0'] = '^2ce9c946a4c879bf11b50b76cc5692cb', ['2.8.8'] = '^8c4a3bcb729b11f703d22a5b39640ca8', ['2.8.7'] = '^3a0d4e7ca4e492ed4dfe476d1ac6018b', ['2.8.6'] = '^fe3f49706e26a9fb36a87bfce9ea36ce', ['2.8.5'] = '^4c7efa31b39e510432a317570d97bbb9', ['2.8.4'] = '^76c72bfd398424dd001b86d0012fe061', ['2.8.3'] = '^fb4641ad0eeb2a34491d15f4eff51063', ['2.8.2'] = '^299932277b7dfe382ce23465333a7d23', ['2.8.1'] = '^e37f2d5ba89a62cd202ee27dac06c8a8', ['2.8.0'] = '^32f0e9b9c06dfe8c9ad5599a636971a1', ['2.7.3'] = '^7f50cc4ebf04c2d9da73abfd69b77aa2', ['2.7.2'] = '^a194e2aaddd0bafb95253dd96dc733eb', ['2.7.1'] = '^8134878582121785ba65ea345d6ba724', ['2.7.0'] = '^07fa128e4754f9447b1dd46374eef360', ['2.6.4'] = '^b927f95219a0fe3600dba3c1182ae55f', ['2.6.3'] = '^b2860e7837f711bef3d0eeb106872ded', ['2.6.2'] = '^5b1cd6fe7d050eda6c93871c107db3d2', ['2.6.1'] = '^66afbc12bbfe6ce108b1f69f4bc917b7', ['2.6.0'] = '^3f3266499ffdbd85950e702298062844', ['2.5.7'] = '^1f4442296b83d7e33a8b45209ba0e590', ['2.5.6'] = '^3c5eba3d8564928e32ae43c3d9924dee', ['2.5.5'] = '^3f267ed621ada7ee6c7d8893ccb0b14b', ['2.5.4'] = '^7a6bf5b7df89642a75a78ef7d657c1c0', ['2.5.3'] = '^df5b1f0f1d5679d9f8512b16c55a6065', ['2.5.2'] = '^861ce5eb72164b190e9e629a31cf4901', ['2.5.1'] = '^9a4a4648f60f8eda7cfcbfe271ee5b7d', ['2.5.0'] = '^9eb3d907ed7ada4e3cbcacb917abc8e4', ['2.4.4'] = '^485a70361b4433b31dea1c6be0df243e', ['2.4.3'] = '^982b7a063a33c143a8eadc88249f6bcc', ['2.4.2'] = '^e7a3fd0c6d771a8f1b8a86a4169c9ea4', ['2.4.1'] = '^75b0653cb281eb26d31ede38c8e1e228', ['2.4.0'] = '^e829c88149bab3c0cee85da60e18ae9b', ['2.3.2'] = '^42a4834c92ab9a7777063afa254bcb69', ['2.3.1'] = '^f697c1afcc2ec8ddcdf99dc7af03a67f', ['2.3.0'] = '^b8f92b2fa2d3fe5fe158344bda1cc6ae', ['2.2.2'] = '^99dc7cc823376b3b33d04357896ae07b', ['2.2.1'] = '^d9118b1e9de5efced9cc9d883f2168ff', ['2.2.0'] = '^85b6cbec480d5c8cd9882c825ac2c244' } }); -------------------------------------------------------------------------------- -- Symantec -------------------------------------------------------------------------------- table.insert(fingerprints, { category = 'fingerprint', vendor = 'Symantic', version = 'Raptor', vids = { ['v8.1'] = '^526170746f7220506f77657256706e20536572766572205b56382e315d', } }); table.insert(fingerprints, { category = 'fingerprint', vendor = 'Symantic', version = 'Raptor', vids = { [''] = '^526170746f7220506f77657256706e20536572766572' } }); -------------------------------------------------------------------------------- -- Timestep -------------------------------------------------------------------------------- table.insert(fingerprints, { category = 'fingerprint', vendor = 'Timestep 1', version = 'SGW', vids = { ['1520 315 2.01E013'] = '^54494d455354455020312053475720313532302033313520322e303145303133' } }); table.insert(fingerprints, { category = 'fingerprint', vendor = 'Timestep', version = 'VPN Gateway', vids = { [''] = '^54494d4553544550' } }); -------------------------------------------------------------------------------- -- ZyXEL -------------------------------------------------------------------------------- table.insert(fingerprints, { category = 'fingerprint', vendor = 'ZyXEL', version = 'ZyWALL', vids = { ['Router'] = '^b858d1addd08c1e8adafea150608aa4497aa6cc8', ['Unknown'] = '^625027749d5ab97f5616c1602765cf480a3b7d0b', -- false positive ? ['USG 100'] = '^f758f22668750f03b08df6ebe1d0' } }); -------------------------------------------------------------------------------- -------------------------------------------------------------------------------- -- Attribute: Misc fingerprints -- not directly usable for fingerprinting -- but can be used for guessing -------------------------------------------------------------------------------- -------------------------------------------------------------------------------- -------------------------------------------------------------------------------- -- Microsoft -------------------------------------------------------------------------------- table.insert(fingerprints, { category = 'attribute', guess = 'Microsoft', vids = { ['GSSAPI'] = '^621b04bb09882ac1e15935fefa24aeee', ['MS NT5 ISAKMPOAKLEY'] = '^1e2b516905991c7d7c96fcbfb587e461', ['A GSS-API Authentication Method for IKE'] = '^ad2c0dd0b9c32083ccba25b8861ec455', ['A GSS-API Authentication Method for IKE\\n'] = '^b46d8914f3aaa3f2fedeb7c7db2943ca', ['Microsoft Initial-Contact'] = '^26244d38eddb61b3172a36e3d0cfb819', ['MS-Negotiation Discovery Capable'] = '^fb1de3cdf341b7ea16b7e5be0855f120', ['IKE CGA version 1'] = '^e3a5966a76379fe707228231e5ce8652', ['MS-MamieExists'] = '^214ca4faffa7f32d6748e5303395ae83', ['NLBS_PRESENT'] = '^72872B95FCDA2EB708EFE322119B4971' } }); -------------------------------------------------------------------------------- -- NetScreen -------------------------------------------------------------------------------- table.insert(fingerprints, { category = 'attribute', guess = 'NetScreen', vids = { -- (HeartBeat_Notify + 386b0100) [''] = '^4865617274426561745f4e6f74696679386b0100' } }); -------------------------------------------------------------------------------- -- Other stuff -------------------------------------------------------------------------------- table.insert(fingerprints, { category = 'attribute', guess = '', vids = { ['Cisco Unity'] = '^12f5f28c457168a9702d9fe274cc0100', ['IKE FRAGMENTATION'] = '^4048b7d56ebce88525e7de7f00d6c2d3', ['Dead Peer Detection v1.0'] = '^afcad71368a1f1c96b8696fc77570100', ['XAUTH'] = '^09002689dfd6b712', ['draft-krywaniuk-ipsec-antireplay-00'] = '^325df29a2319f2dd', ['draft-ietf-ipsec-heartbeats-00'] = '^8db7a41811221660', ['ESPThruNAT'] = '^50760f624c63e5c53eea386c685ca083', ['Testing NAT-T RFC'] = '^c40fee00d5d39ddb1fc762e09b7cfea7', ['RFC 3947 NAT-T'] = '^4a131c81070358455c5728f20e95452f', ['RFC XXXX'] = '^810fa565f8ab14369105d706fbd57279', ['Heartbeat Notify'] = '^4865617274426561745f4e6f74696679', -- might contain version information ['draft-ietf-ipsec-nat-t-ike'] = '^4df37928e9fc4fd1b3262170d515c662', ['draft-ietf-ipsec-nat-t-ike-00'] = '^4485152d18b6bbcd0be8a8469579ddcc', ['draft-ietf-ipsec-nat-t-ike-01'] = '^16f6ca16e4a4066d83821a0f0aeaa862', ['draft-ietf-ipsec-nat-t-ike-02\\n'] = '^90cb80913ebb696e086381b5ec427b1f', ['draft-ietf-ipsec-nat-t-ike-02'] = '^cd60464335df21f87cfdb2fc68b6a448', ['draft-ietf-ipsec-nat-t-ike-03'] = '^7d9419a65310ca6f2c179d9215529d56', ['draft-ietf-ipsec-nat-t-ike-04'] = '^9909b64eed937c6573de52ace952fa6b', ['draft-ietf-ipsec-nat-t-ike-05'] = '^80d0bb3def54565ee84645d4c85ce3ee', ['draft-ietf-ipsec-nat-t-ike-06'] = '^4d1e0e136deafa34c4f3ea9f02ec7285', ['draft-ietf-ipsec-nat-t-ike-07'] = '^439b59f8ba676c4c7737ae22eab8f582', ['draft-ietf-ipsec-nat-t-ike-08'] = '^8f8d83826d246b6fc7a8a6a428c11de8', ['draft-ietf-ipsec-nat-t-ike-09'] = '^42ea5b6f898d9773a575df26e7dd19e1', ['IKE Challenge-Response'] = '^ba290499c24e84e53a1d83a05e5f00c9', ['IKE Challenge-Response-2'] = '^0d33611a5d521b5e3c9c03d2fc107e12', ['IKE Challenge-Response Revised'] = '^ad3251042cdc4652c9e0734ce5de4c7d', ['IKE Challenge-Response Revised-2'] = '^13f11823f966fa91900f024ba66a86ba', ['draft-stenberg-ipsec-nat-traversal-01'] = '^27bab5dc01ea0760ea4e3190ac27c0d0', ['draft-stenberg-ipsec-nat-traversal-02'] = '^6105c422e76847e43f9684801292aecd', ['draft-huttunen-ipsec-esp-in-udp-00.txt'] = '^6a7434c19d7e36348090a02334c9c805', } }); table.insert(fingerprints, { category = 'attribute', guess = '', vids = { ['Dead Peer Detection'] = '^afcad71368a1f1c96b8696fc7757....', } }); -------------------------------------------------------------------------------- -------------------------------------------------------------------------------- -- vid_order: -- By examining the ordering of the VIDs, some assumptions can be made -- Currently only has support for Cisco -------------------------------------------------------------------------------- -- Cisco -------------------------------------------------------------------------------- table.insert(fingerprints, { category = 'vid_ordering', vendor = 'Cisco', vids = { -- This should not be necessary -- Cisco Unity, XAUTH, Dead Peer Detection v1.0, IKE Fragmentation, 'random hash', Cisco VPN Concentrator --['VPN Concentrator'] = '^12f5f28c457168a9702d9fe274cc010009002689dfd6b712afcad71368a1f1c96b8696fc775701004048b7d56ebce88525e7de7f00d6c2d3c0000000................................1f07f70eaa6514d3b0fa96542a......', -- Cisco Unity, Dead Peer Detection v1.0, junk, XAUTH ['IOS 12.3/12.4'] = '^12f5f28c457168a9702d9fe274cc0100afcad71368a1f1c96b8696fc77570100................................09002689dfd6b712', -- XAUTH, Cisco Unity, Dead Peer Detection, junk ['PIX OS 6.2.x'] = '^09002689dfd6b71212f5f28c457168a9702d9fe274cc0100afcad71368a1f1c96b8696fc77570100................................', -- XAUTH, Dead Peer Detection v1.0, Cisco Unity, junk ['PIX OS 6.3.x'] = '^09002689dfd6b712afcad71368a1f1c96b8696fc7757010012f5f28c457168a9702d9fe274cc0100................................', --Cisco Unity, XAUTH, Dead Peer Detection v1.0, IKE Fragmentation, Cisco VPN Concentrator ['PIX OS 7.0.x'] = '^12f5f28c457168a9702d9fe274cc010009002689dfd6b712afcad71368a1f1c96b8696fc775701004048b7d56ebce88525e7de7f00d6c2d3c00000001f07f70eaa6514d3b0fa96542a......', -- Cisco Unity, XAUTH, IKE Fragmentation, Cisco VPN Concentrator ['PIX OS 7.1 or later'] = '^12f5f28c457168a9702d9fe274cc010009002689dfd6b7124048b7d56ebce88525e7de7f00d6c2d3c00000001f07f70eaa6514d3b0fa96542a......' } }); table.insert(fingerprints, { category = 'vid_ordering', vendor = 'Cisco', vids = { -- Cisco Unity, Dead Peer Detection, junk ['PIX OS 6.0/6.1'] = '^12f5f28c457168a9702d9fe274cc0100afcad71368a1f1c96b8696fc77570100................................', } }); --[[table.insert(fingerprints, { category = 'vid_ordering', vendor = 'Cisco', vids = { -- This version of PIX OS / IOS only returns a 'random' VID -- This is only used for length calculation -- Might create false positive matches ['PIX OS 5.x or IOS 12.0-12.2'] = '^................................', } });]]