Created: 2022-07-03
Tags: #literature
Abstract
Every packet is sent to a port of the target server and depending of the reply will determine if the port is OPEN or CLOSED. It is not that easy to identify if a port is behind the firewall.
Should be NO RESPONSE.
Then request is sent a second time as a double check.
open|filtered. If there's UDP RESPONSE (which is very unusual),
The target (the one who received the sent packet)
UDP scans tend to be incredibly slow in comparison to the various TCP scans (in the region of 20 minutes to scan the first 1000 ports, with a good connection).
The difficulty whether a UDP port is actually open is why slowness exists.
It's usually good practice to run an Nmap scan with
--top-ports <number> .
For example, scanning with nmap -sU --top-ports 20 <target>.
Will scan the top 20 most commonly used UDP ports, resulting in a much more acceptable scan time.
When scanning UDP ports, Nmap usually sends completely empty requests -- just raw UDP packets. That said, for ports which are usually occupied by well-known services, it will instead send a protocol-specific payload which is more likely to elicit a response from which a more accurate result can be drawn.