Capture Ike Phase 1 packets

[mohamed.fawzy2012]

if i want to capture packets of IKE phase 1 using capture command , is this the right command

 capture match udp eq port 500 eq port 500

i found this in cisco document 

• ikev1/ikev2 - Captures only Internet Key Exchange Version 1 (IKEv1) or IKEv2 protocol information.
  
  
• isakmp - Captures Internet Security Association and Key Management Protocol (ISAKMP) traffic for VPN connections. The ISAKMP subsystem does not have access to the upper-layer protocols. The capture is a pseudo capture, with the physical, IP, and UDP layers combined together in order to satisfy a PCAP parser. The peer addresses are obtained from the SA exchange and are stored in the IP layer.

but i don't understand this

[Karsten Iwen]

with that capture you could miss some of the Phase1-packets depending on the infrastructure and your peer. The source-port doesn't have to be udp/500 and the destination can also be udp/4500.