---
name: "racoon"
section: "8"
platform: "macos"
package: "ipsec"
version: "1125"
release: "macOS 26.5"
platforms: ["linux", "macos"]
url: "https://new.carta.tech/racoon"
---

# racoon(8)

IKE (ISAKMP/Oakley) key management daemon

## NAME

**racoon** – IKE (ISAKMP/Oakley) key management daemon

## SYNOPSIS

**racoon** \[**-46BdFLv**\] \[**-f** *configfile*\] \[**-l** *logfile*\]

## DESCRIPTION

**racoon** is used to setup and maintain an IPSec tunnel or transport channel,  between two devices, over which network traffic is conveyed securely.  This security is made possible by cryptographic keys and operations  on both devices. **racoon** relies on a standardized network protocol (IKE) to automatically  negotiate and manage the cryptographic keys (e.g. security  associations) that are necessary for the  IPSec tunnel or transport channel to function. **racoon** speaks the IKE (ISAKMP/Oakley) key management protocol, to establish security associations with other hosts. The SPD (Security Policy Database) in the kernel usually triggers **racoon**. **racoon** usually sends all informational messages, warnings and error messages to [syslogd(8)](/syslogd/8.md) with the facility LOG\_DAEMON and the priority LOG\_INFO. Debugging messages are sent with the priority LOG\_DEBUG. You should configure [syslog.conf(5)](/syslog.conf/5.md) appropriately to see these messages.

- **-4**

  - **-6**

  Specify the default address family for the sockets.

- **-B**

  Install SA(s) from the file which is specified in [racoon.conf(5)](/racoon.conf/5.md).

- **-d**

  Increase the debug level. Multiple **-d** arguments will increase the debug level even more.

- **-F**

  Run **racoon** in the foreground.

- **-f** *configfile*

  Use *configfile* as the configuration file instead of the default.

- **-L**

  Include *file\_name:line\_number:function\_name* in all messages.

- **-l** *logfile*

  Use *logfile* as the logging file instead of [syslogd(8)](/syslogd/8.md).

- **-v**

  This flag causes the packet dump be more verbose, with higher debugging level.

**racoon** assumes the presence of the kernel random number device rnd(4) at */dev/urandom*.

## RETURN VALUES

The command exits with 0 on success, and non-zero on errors.

## FILES

- */private/etc/racoon/racoon.conf*

  default configuration file.

- */private/etc/racoon/psk.txt*

  default pre-shared key file.

## SEE ALSO

[ipsec(4)](/ipsec/4.md), [racoon.conf(5)](/racoon.conf/5.md), [syslog.conf(5)](/syslog.conf/5.md), [setkey(8)](/setkey/8.md), [syslogd(8)](/syslogd/8.md)

## HISTORY

The **racoon** command first appeared in the “YIPS” Yokogawa IPsec implementation.

## SECURITY CONSIDERATIONS

The use of IKE phase 1 aggressive mode is not recommended, as described in *http://www.kb.cert.org/vuls/id/886601*.