[kampji]

Summary

Adds a --nat-t / --natt flag that passes --nat-t to every ike-scan invocation, so IKESS can audit gateways over NAT-T encapsulation (RFC 3947, UDP 4500) as well as the default UDP 500.

Motivation

Some environments filter or ignore UDP 500 but expose UDP 4500. A default scan against them reports "No IKE services found" even though a gateway is listening. With this flag, the full IKESS flow can run against 4500: v1/v2 discovery, Aggressive Mode, transforms, and fingerprinting.

Ran into this on external penetration testing engagements where UDP 4500 was detected.

Changes

• New CLI flag --nat-t (alias --natt). Off by default, so existing behavior is unchanged.
• run_command() prepends any extra global ike-scan args (EXTRA_IKESCAN_ARGS) to every ike-scan call. This keeps the change in one place instead of touching each scan function.
• Reports record the transport:
  • JSON/XML scan_info gains nat_t (bool) and udp_port (500/4500).
  • The HTML header shows a transport badge (UDP 500 or NAT-T (UDP 4500)).
  • NAT-T report filenames get a _natt4500 suffix, so a 500 scan and a 4500 scan of the same target don't get mixed up.
• Help text and examples updated.

Notes / limitations

• Many gateways only answer on 4500 after NAT detection on 500. A lack of response with --nat-t doesn't prove no service is there. The help text says so.
• ike-scan --nat-t binds source port 4500 locally. If something on the scanning host already holds that port (e.g. strongSwan/charon, a VPN client), ike-scan will fail to bind.

[l4rm4nd]

Very nice. Thanks for the PR!

[kampji]

@l4rm4nd Very welcome! Thanks for the tool.