Why does Openvas send IPSEC connection requests?
Hello and welcome to this community portal.
In general it is in the nature of a vulnerability scanner to probe the remote host and it’s services in different ways.
This includes the previously mentioned port scanner but also additional “probing” for services to do the service detection of these. Most likely the IPSEC connection request is originating from either this probing for services supporting IPSEC/IKE or from actual vulnerability checks on such kind of services.
If unsure what things a vulnerability scanner is actually doing the following high level description is available:
https://docs.greenbone.net/GSM-Manual/gos-21.04/en/read-before-use.html
1 Like