Capture Ike Phase 1 packets

mohamed.fawzy2012 — Tue, 12 Mar 2019 09:18:17 GMT

if i want to capture packets of IKE phase 1 using capture command , is this the right command

capture match udp eq port 500 eq port 500

i found this in cisco document

ikev1/ikev2 - Captures only Internet Key Exchange Version 1 (IKEv1) or IKEv2 protocol information.
isakmp - Captures Internet Security Association and Key Management Protocol (ISAKMP) traffic for VPN connections. The ISAKMP subsystem does not have access to the upper-layer protocols. The capture is a pseudo capture, with the physical, IP, and UDP layers combined together in order to satisfy a PCAP parser. The peer addresses are obtained from the SA exchange and are stored in the IP layer.

but i don't understand this

with that capture you could

Karsten Iwen — Wed, 03 May 2017 10:40:47 GMT

with that capture you could miss some of the Phase1-packets depending on the infrastructure and your peer. The source-port doesn't have to be udp/500 and the destination can also be udp/4500.

topic Capture Ike Phase 1 packets in Network Security

Capture Ike Phase 1 packets

with that capture you could