{"id":1637,"date":"2009-10-08T19:16:09","date_gmt":"2009-10-08T23:16:09","guid":{"rendered":"http:\/\/www.schollnick.net\/wordpress\/?p=1637"},"modified":"2009-10-09T14:16:37","modified_gmt":"2009-10-09T18:16:37","slug":"why-is-a-racoon-nibbling-on-my-macintosh","status":"publish","type":"post","link":"http:\/\/www.schollnick.net\/wordpress\/2009\/10\/why-is-a-racoon-nibbling-on-my-macintosh\/","title":{"rendered":"Why is a Racoon nibbling on my Macintosh?"},"content":{"rendered":"<p>I think I need to start to put some Racoon feeders out, because I keep hearing some odd noises&#8230; \u00c2\u00a0Coming from the console&#8230;.<\/p>\n<div id=\"_mcePaste\" style=\"position: absolute; left: -10000px; top: 0px; width: 1px; height: 1px; overflow-x: hidden; overflow-y: hidden;\">10\/8\/09 6:48:56 PM<span style=\"white-space: pre;\"> <\/span>racoon[240]<span style=\"white-space: pre;\"> <\/span>IKE Packet: receive success. (Responder, Aggressive-Mode message 1).<\/div>\n<div id=\"_mcePaste\" style=\"position: absolute; left: -10000px; top: 0px; width: 1px; height: 1px; overflow-x: hidden; overflow-y: hidden;\">10\/8\/09 6:48:56 PM<span style=\"white-space: pre;\"> <\/span>racoon[240]<span style=\"white-space: pre;\"> <\/span>IKE Packet: transmit success. (Responder, Aggressive-Mode message 2).<\/div>\n<div id=\"_mcePaste\" style=\"position: absolute; left: -10000px; top: 0px; width: 1px; height: 1px; overflow-x: hidden; overflow-y: hidden;\">10\/8\/09 6:48:56 PM<span style=\"white-space: pre;\"> <\/span>racoon[240]<span style=\"white-space: pre;\"> <\/span>IKEv1 Phase1 AUTH: success. (Responder, Aggressive-Mode Message 3).<\/div>\n<div id=\"_mcePaste\" style=\"position: absolute; left: -10000px; top: 0px; width: 1px; height: 1px; overflow-x: hidden; overflow-y: hidden;\">10\/8\/09 6:48:56 PM<span style=\"white-space: pre;\"> <\/span>racoon[240]<span style=\"white-space: pre;\"> <\/span>IKE Packet: receive success. (Responder, Aggressive-Mode message 3).<\/div>\n<div id=\"_mcePaste\" style=\"position: absolute; left: -10000px; top: 0px; width: 1px; height: 1px; overflow-x: hidden; overflow-y: hidden;\">10\/8\/09 6:48:56 PM<span style=\"white-space: pre;\"> <\/span>racoon[240]<span style=\"white-space: pre;\"> <\/span>IKEv1 Phase1 Responder: success. (Responder, Aggressive-Mode).<\/div>\n<div id=\"_mcePaste\" style=\"position: absolute; left: -10000px; top: 0px; width: 1px; height: 1px; overflow-x: hidden; overflow-y: hidden;\">10\/8\/09 6:49:01 PM<span style=\"white-space: pre;\"> <\/span>racoon[240]<span style=\"white-space: pre;\"> <\/span>IKE Packet: transmit success. (Information message).<\/div>\n<div id=\"_mcePaste\" style=\"position: absolute; left: -10000px; top: 0px; width: 1px; height: 1px; overflow-x: hidden; overflow-y: hidden;\">10\/8\/09 6:49:01 PM<span style=\"white-space: pre;\"> <\/span>racoon[240]<span style=\"white-space: pre;\"> <\/span>IKEv1 Information-Notice: transmitCom success. (Delete ISAKMP-SA).<\/div>\n<pre>10\/8\/09 6:48:56 PM<span style=\"white-space: pre;\">\t<\/span>racoon[240]<span style=\"white-space: pre;\">\t<\/span>IKE Packet: receive success. (Responder, \r\n     Aggressive-Mode message 1).\r\n10\/8\/09 6:48:56 PM<span style=\"white-space: pre;\">\t<\/span>racoon[240]<span style=\"white-space: pre;\">\t<\/span>IKE Packet: transmit success. (Responder, \r\n     Aggressive-Mode message 2).\r\n10\/8\/09 6:48:56 PM<span style=\"white-space: pre;\">\t<\/span>racoon[240]<span style=\"white-space: pre;\">\t<\/span>IKEv1 Phase1 AUTH: success. (Responder, \r\n     Aggressive-Mode Message 3).\r\n10\/8\/09 6:48:56 PM<span style=\"white-space: pre;\">\t<\/span>racoon[240]<span style=\"white-space: pre;\">\t<\/span>IKE Packet: receive success. (Responder, \r\n     Aggressive-Mode message 3).\r\n10\/8\/09 6:48:56 PM<span style=\"white-space: pre;\">\t<\/span>racoon[240]<span style=\"white-space: pre;\">\t<\/span>IKEv1 Phase1 Responder: success. (Responder, \r\n     Aggressive-Mode).\r\n10\/8\/09 6:49:01 PM<span style=\"white-space: pre;\">\t<\/span>racoon[240]<span style=\"white-space: pre;\">\t<\/span>IKE Packet: transmit success. (Information message).\r\n10\/8\/09 6:49:01 PM<span style=\"white-space: pre;\">\t<\/span>racoon[240]<span style=\"white-space: pre;\">\t<\/span>IKEv1 Information-Notice: transmit success. (Delete ISAKMP-SA).<\/pre>\n<p>From my understanding, see the manual page below, racoon is a daemon responsible for managing the IKE protocol.<\/p>\n<pre style=\"font-family: monaco, 'Courier New', courier, monospace; font-size: 10px;\"><tt style=\"letter-spacing: -0.23px; font-size: 12px; font-family: Monaco, Courier, monospace;\"><strong>NAME<\/strong>\r\n     <strong>racoon<\/strong> -- IKE (ISAKMP\/Oakley) key management daemon\r\n\r\n<strong>SYNOPSIS<\/strong>\r\n     <strong>racoon<\/strong> [<strong>-46BdFLv<\/strong>] [<strong>-f<\/strong> <span style=\"text-decoration: underline;\">configfile<\/span>] [<strong>-l<\/strong> <span style=\"text-decoration: underline;\">logfile<\/span>] [<strong>-P<\/strong> <span style=\"text-decoration: underline;\">isakmp-natt-port<\/span>] [<strong>-p<\/strong> <span style=\"text-decoration: underline;\">isakmp-port<\/span>]\r\n\r\n<strong>DESCRIPTION<\/strong>\r\n     <strong>racoon<\/strong> speaks the IKE (ISAKMP\/Oakley) key management protocol, to establish security associations with\r\n     other hosts.  The SPD (Security Policy Database) in the kernel usually triggers <strong>racoon<\/strong>.  <strong>racoon<\/strong> usually\r\n     sends all informational messages, warnings and error messages to <a style=\"color: #0000ff; text-decoration: none;\" href=\"http:\/\/developer.apple.com\/mac\/library\/documentation\/Darwin\/Reference\/ManPages\/man8\/syslogd.8.html#\/\/apple_ref\/doc\/man\/8\/syslogd\">syslogd(8)<\/a> with the facility\r\n     LOG_DAEMON and the priority LOG_INFO.  Debugging messages are sent with the priority LOG_DEBUG.  You\r\n     should configure <a style=\"color: #0000ff; text-decoration: none;\" href=\"http:\/\/developer.apple.com\/mac\/library\/documentation\/Darwin\/Reference\/ManPages\/man5\/syslog.conf.5.html#\/\/apple_ref\/doc\/man\/5\/syslog.conf\">syslog.conf(5)<\/a> appropriately to see these messages.<\/tt><\/pre>\n<pre style=\"font-family: monaco, 'Courier New', courier, monospace; font-size: 10px;\"><span style=\"font-family: Georgia, 'Times New Roman', 'Bitstream Charter', Times, serif; line-height: 19px; white-space: normal; font-size: 13px;\">From my understanding, see the manual page below, racoon is a daemon responsible for managing the IKE protocol. \u00c2\u00a0The IKE protocol use a key exchange method to setup a shared session secret, from which the security keys are derived from. \u00c2\u00a0<\/span><\/pre>\n<pre style=\"font-family: monaco, 'Courier New', courier, monospace; font-size: 10px;\"><span style=\"font-family: Georgia, 'Times New Roman', 'Bitstream Charter', Times, serif; font-size: small;\"><span style=\"line-height: 19px; white-space: normal;\">\r\n<\/span><\/span><\/pre>\n","protected":false},"excerpt":{"rendered":"<p>I think I need to start to put some Racoon feeders out, because I keep hearing some odd noises&#8230; \u00c2\u00a0Coming from the console&#8230;. 10\/8\/09 6:48:56 PM racoon[240] IKE Packet: receive success. (Responder, Aggressive-Mode message 1). 10\/8\/09 6:48:56 PM racoon[240] IKE Packet: transmit success. (Responder, Aggressive-Mode message 2). 10\/8\/09 6:48:56 PM racoon[240] IKEv1 Phase1 AUTH: success. <a class=\"read-more\" href=\"http:\/\/www.schollnick.net\/wordpress\/2009\/10\/why-is-a-racoon-nibbling-on-my-macintosh\/\">[&hellip;]<\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_monsterinsights_skip_tracking":false,"_monsterinsights_sitenote_active":false,"_monsterinsights_sitenote_note":"","_monsterinsights_sitenote_category":0},"categories":[12,5,25],"tags":[91,1838],"_links":{"self":[{"href":"http:\/\/www.schollnick.net\/wordpress\/wp-json\/wp\/v2\/posts\/1637"}],"collection":[{"href":"http:\/\/www.schollnick.net\/wordpress\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/www.schollnick.net\/wordpress\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/www.schollnick.net\/wordpress\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"http:\/\/www.schollnick.net\/wordpress\/wp-json\/wp\/v2\/comments?post=1637"}],"version-history":[{"count":0,"href":"http:\/\/www.schollnick.net\/wordpress\/wp-json\/wp\/v2\/posts\/1637\/revisions"}],"wp:attachment":[{"href":"http:\/\/www.schollnick.net\/wordpress\/wp-json\/wp\/v2\/media?parent=1637"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/www.schollnick.net\/wordpress\/wp-json\/wp\/v2\/categories?post=1637"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/www.schollnick.net\/wordpress\/wp-json\/wp\/v2\/tags?post=1637"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}<!-- WP Super Cache is installed but broken. The constant WPCACHEHOME must be set in the file wp-config.php and point at the WP Super Cache plugin directory. -->