Roper stops ISAKMP traffic (port 500 udp) used to create a SA.
If client is configured to fall back to unsecure comunications
after key exchange failure and server accepts non ipsec traffic
(incoming and outgoing) you can see connections in plaintext and you can
manipulate it even if ESP or AH are used as default.

It can fails if tunnel-mode ESP is used to reach non public or firewalled IPs
or if particular methods are used to authenticate sessions on a VPN gateway.

N.B.
You have to use it during an arp poisoning session.

You have to catch a session from the beginning of a ISAKMP SA creation.

You have to have fun :)
