output to be parsed: Starting ike-scan 1.7 with 1 hosts (http://www.nta-monitor.com/ike-scan/) 206.47.249.40 Main Mode Handshake returned SA=(Enc=3DES Hash=SHA1 Auth=RSA_Sig Group=2:modp1024 LifeType=Seconds LifeDuration(4)=0x00007080) IKE Backoff Patterns: IP Address No. Recv time Delta Time 206.47.249.40 1 1161963569.839546 0.000000 206.47.249.40 2 1161963585.624889 15.785343 206.47.249.40 3 1161963601.627019 16.002130 206.47.249.40 4 1161963617.628598 16.001579 206.47.249.40 Implementation guess: Nortel Contivity Ending ike-scan 1.7: 1 hosts scanned in 107.950 seconds (0.01 hosts/sec). 1 returned handshake; 0 returned notify python script to parse it: import re from os import access,F_OK def parse (inFile): if access(inFile,F_OK)==False: return None file = open(inFile,'r') txt = file.read() file.close() print txt if "1 returned handshake" in txt: lines = re.split("\n",txt) ikeInfo={} # Will contain all the IKE info for line in lines: print line if "Main Mode" in line: parts = re.split(r"\(",line) algparts = re.split(" ",parts[1]) encparts = re.split("=",algparts[0]) ikeInfo["Enc"] = encparts[1] hashparts = re.split("=",algparts[1]) ikeInfo["Hash"] = hashparts[1] authparts = re.split("=",algparts[2]) ikeInfo["Auth"] = authparts[1] groupparts = re.split("=",algparts[3]) ikeInfo["Group"] = groupparts[1] durparts = re.split("=",algparts[5]) ikeInfo["Duration"] = durparts[1] if "Implementation" in line: implparts = re.split(": ",line) ikeInfo["Implementation"] = implparts[1] print ikeInfo return ikeInfo