When the Internet Key Exchange (IKE) daemon detects a large number of half-open IKE security associations (SAs), it sends a notify payload of type COOKIE to the peer. The peer must duplicate and send back the COOKIE notify payload. The IKE daemon periodically updates the local cookie information and requires that the data in all received COOKIE notify payloads match the local cookie information. If the received cookie data does not match the local cookie information, then it might indicate that the sender is attempting a denial-of-service (DoS) attack against the IKE daemon. This message might be issued with a benign IKE daemon peer if the local cookie information is updated before the peer is able to respond, although such an occurrence is unlikely. A large number of these messages probably indicates a DoS attack.