ike-scan discovers IKE hosts and can also fingerprint them using the
retransmission backoff pattern.
ike-scan does two things:
a) Discovery: Determine which hosts are running IKE.
   This is done by displaying those hosts which respond to the IKE requests
   sent by ike-scan.
b) Fingerprinting: Determine which IKE implementation the hosts are using.
   This is done by recording the times of the IKE response packets from the
   target hosts and comparing the observed retransmission backoff pattern
   against known patterns.

WWW: http://www.nta-monitor.com/ike-scan