500

Port 500/tcp carries the same IANA registration as 500/udp (isakmp), but IKE/ISAKMP overwhelmingly runs over UDP in practice, so a live 500/tcp listener is uncommon and should stay internal-only if it appears at all rather than being treated as a normal public-facing service.

IANA lists isakmp on both 500/tcp and 500/udp under assignee Mark Schertler, with the Reference column blank in the current registry — no RFC is cited against the entry itself, though ISAKMP is formally defined in RFC 2408 and IKE in RFC 2409/RFC 7296.

Every piece of concrete real-world evidence found — Cisco ASA's IKEv1/v2 implementation (CVE-2016-1287), the tcpdump ISAKMP parser (CVE-2017-5205), and the ike-scan reconnaissance tool — concerns ISAKMP/IKE traffic generically or the UDP side specifically; SANS ISC's port-500 tracking page reports TCP and UDP together and does not isolate TCP-specific sightings. No source in this research distinguished a TCP-specific application or incident from the UDP baseline.

Because the registration is formally shared rather than TCP being a separately documented deployment path, this entry treats 500/tcp as the same protocol family as 500/udp but with negligible independent real-world usage, and flags that gap honestly rather than inventing TCP-specific detail.

IANA assignment

isakmp — service name "isakmp"; Reference column blank; assignee/contact Mark_Schertler; registration/modification dates blank; same registration also covers 500/udp [Confirmed] — the IANA Service Name and Transport Protocol Port Number Registry isakmp 500/tcp

Range class

well-known (0–1023) [Confirmed] — the IANA Service Name and Transport Protocol Port Number Registry isakmp 500/tcp

Prevalence

nmap-services open-frequency for 500/tcp = 0.001129 (~0.11%), versus 500/udp = 0.163742 (~16.4%) [Confirmed] — this site's own tooling, port 500

Related ports

500/udp (the primary ISAKMP/IKE port, same registration), 4500/udp (NAT-T)

Primary use

IANA-registered alongside 500/udp for ISAKMP/IKE, but real-world IKE/IPsec negotiation runs almost exclusively over UDP 500 (and 4500/udp for NAT-T); TCP is a rare/non-standard configuration for this service

Other/unofficial uses

none TCP-specific found; UDP-side uses (IKEv2 client VPNs, L2TP/IPsec) do not have a distinct TCP-side counterpart documented in this research [Unknown]

Security implications

any exposed 500/tcp should be treated as internal/VPN-infrastructure only; related CVE-2016-1287 (Cisco ASA IKE, SANS ISC-tracked scanning) and CVE-2017-5205 (tcpdump ISAKMP parser) both concern ISAKMP/IKE handling generically rather than TCP-500 specifically; ike-scan targets port 500 for gateway fingerprinting [Likely] — https://isc.sans.edu/diary/Critical+Cisco+ASA+IKEv1v2+Vulnerability.+Active+Scanning+Detected/20719, https://isc.sans.edu/data/port.html?port=500

Typically seen on

firewalls/VPN gateways that also expose 500/udp, if TCP transport is enabled for IKE at all; no vendor-specific TCP-only deployment documented [Unknown]

Analyst note

A responsive 500/tcp is unusual given IKE's near-total reliance on UDP; verify it is genuinely IKE-related (not a misconfigured or decoy listener) before assuming standard VPN-gateway behavior.

Port 500/udp is the standard port for IPsec key negotiation, registered with IANA as isakmp with the description "isakmp," assignee and contact Mark Schertler, and with the registration date, modification date, and reference fields all blank; the same registration also covers 500/tcp. ISAKMP, the Internet Security Association and Key Management Protocol (RFC 2408), provides the framework, and the Internet Key Exchange runs over UDP 500 to establish the Security Associations that IPsec's ESP and AH then use to protect traffic. IKEv1 (RFC 2409, 1998) negotiates in two phases — Phase 1 in either Main mode or Aggressive mode, followed by Phase 2 in Quick mode — while IKEv2 (RFC 7296, 2014; originally RFC 4306, 2005) streamlines this into a simpler, more robust exchange. When a NAT device is detected between the peers, IKE migrates the session from UDP 500 to UDP 4500 and begins UDP-encapsulating ESP. The defining security exposure is IKEv1 Aggressive Mode with a pre-shared key: in the three-message Aggressive-mode exchange the responder sends a hash of the PSK in the clear, which an attacker can capture with a tool such as ike-scan (using --pskcrack) and then crack offline with psk-crack, Hashcat (mode 5300), or John the Ripper — entirely without alerting the VPN owner; ike-scan can also fingerprint VPN gateways by vendor. The mitigations are to disable Aggressive Mode, prefer IKEv2, and avoid PSKs or use very strong ones. For an analyst, an open 500/udp marks an IPsec VPN gateway; test for IKEv1 Aggressive Mode and PSK use with ike-scan, and if present treat it as a high-value offline-cracking target.

IANA assignment

isakmp — "isakmp"; reference (blank); assignee/contact Mark Schertler; registration/modification dates blank; same registration covers 500/tcp [IANA-assigned] — IANA Service Name and Transport Protocol Port Number Registry (confirmed verbatim from live CSV this session)

Range class

well-known (0–1023)

Prevalence

in Nmap's default top-1000 UDP ports (de-facto, nmap-services) [Well-established] — nmap-services file

Related ports

4500/udp (NAT-T — the pair), ESP (IP protocol 50), AH (protocol 51), 1701 (L2TP), 1723 (PPTP)

Primary use

IKE/ISAKMP key negotiation for IPsec

Other/unofficial uses

L2TP/IPsec and IKEv2 client VPNs negotiate here [Well-established]

Security implications

IKEv1 Aggressive Mode + PSK → responder sends PSK hash in the clear → offline crack via ike-scan --pskcrack / psk-crack / Hashcat 5300 / John, without alerting the owner; ike-scan VPN-gateway fingerprinting; mitigate by disabling Aggressive Mode, preferring IKEv2, avoiding/strengthening PSKs

Typically seen on

firewalls and VPN gateways (Cisco, Palo Alto, SonicWall, WatchGuard, Juniper, Fortinet), routers

Analyst note

An open 500/udp = IPsec VPN gateway. Test for IKEv1 Aggressive Mode/PSK with ike-scan; if present, treat as a high-value offline-cracking target.