Hello everyone. So in
this video we are going to see how does a UDP
scan type works.
So the syntax of the UDP scan is
and map hyphen Su the
target IP address and the Target Port
number.
So UDP scanning utilizes UDP
and icmp packets to discover the
status of any port.
And map sends an empty UDP packet
and either receives no reply or
an icmp Port unreachable packet. We
are going to understand this into the packet breakdown in
depth.
But due to udp's connection less nature the
output can be unreliable at many
times.
So what actually happens in the UDP type
of scan?
As you can see on the left hand side is the nmap machine
through which we are going to scan this particular server,
which is on the right hand side.
So the first request that has been sent is a UDP
request.
and if icmp is
received then we consider that
the port is open if we
do not receive any response then we
See that the port is closed.
so
what happens?
As you can see over here, this is the response and
this is the state of the port.
If any UDP response we get from the Target
Port then the port is considered as
open by nmap.
If no responses received even after retransmissions of
the packets, then the state is considered
as open or filtered.
If icmp Port unreachable error comes
then the port.
Is considered as closed?
So, let's see the packet breakdown using Wireshark of
the UDP scan type.
As you can see over here a UDP request
has been sent on the port number.
this
88
and 89
as you can see destination unreachable Port
unreachable has been received for this
particular packet.
So it is not able to identify that what
is the port status in this case? The
port is closed.
so interesting scenario Port status
You will be able to see open or filtered instead
of open or close. Why?
Yes why the answer is when nmap received
no reply from Port once scenario could
be that put 88 and 138 that
we are going to see into a practical scan is really
open.
Is therefore not responding with any reply? However,
another possible scenario is that
the firewall is filtering out our traffic and thus
the UDP packet never reaches the Target and
we receive no reply.
That's why we see the status as open or filtered.
Either way, we won't know what is the difference which results
in nmap displaying open and filtered?
So what are the advantages and disadvantages of?
UDP scan the advantage is it allows the scanning
of the UDP ports?
The disadvantage is it is unreliable at
many times because we cannot identify the
exact status of the port.
So it is the Practical time and let's see UDP
scan in action.
As you can see over here.
On my terminal I'm going to type the command, which is nmap.
and the target IP address
now
The UDP flag that is Su and hyphen
V to see the output in verbose mode.
As you can see initiating UDP scan and
UDP scan has been successfully started.
We have discovered two open ports. That is 1 3 7 and 5
3 5 3.
As you can see the scan has been completed successfully and
we have identified that Port 137
is open and 5353 is open,
but we have not able to identify the exact status
of Port 88 and Port 138
as you can see the state is
open and filtered.
So the host is up and we have identified two
open and two open and filter types
of Port. Let's see what happened into the background in
Wireshark.
So I'm going to apply the filter.
As you can see here.
Icmp type of requests are beans
sent as you can see over here destination and
reachable, which means the port is closed.
As you can see more requests are sent for ports. And
if we get a response that is destination unreachable,
then the port is considered as
closed.
As you can see most of the ports are closed. We
only found two open ports.
Let's see on the target side. What
happened?
So this is that Target side.
The packet capturing was happening.
And you can see most of the packets are unreachable, which
means we are not able to identify that
the port is closed.
or open
I hope you guys understood.
That how a UDP scan type works.
Thank you.