UDP scan is activated with the -­sU option. UDP scan works by sending a UDP packet to every
targeted port. For some common ports, such as 53 and 161, a protocol-­specific payload is sent to increase response rate,
rate.
but for most ports the packet is empty. Well, there are some options to force Nmap to send non-­empty packets,
such as data parameter. Because UDP scanning is generally slower and more difficult than TCP,
some security auditors ignore these ports.
I think this is a mistake, as exploitable UDP services are quite common and attackers certainly don't
ignore the whole protocol.
So in general destination systems do not respond when they receive a UDP packet.
So, Nmap doesn’t recognise if the port is open or filtered when there is no response from the target system.
In this case, the port is flagged as “open or filtered”. To force the systems to respond to our packets,
you should better use UDP scan with version detection option.
You'll have much more accurate results.
Let’s perform an Nmap UDP scan in our virtual network. Go to Kali and open a terminal screen.
I want to scan my Metasploitable system.
Let’s create the UDP scan command: nmap is the command itself, -n is to avoid the DNS resolution.
I’d like to see the IP addresses. -­Pn is to avoid the host discovery.
We have seen these before. sU is to do UDP scan.
Now here's the target IP address 172.16.99.206.
Let’s keep it fast, scan for the top 10 ports only. I use -top-ports parameter for this purpose.
Now as I said a minute ago UDP scan should run with version detection. Use -­sV parameter
use a version detection.
I’d like to add one more parameter here, which is -reason. Reason parameter is used to show the reason
why the state of the port is set as open, close, or filtered.
Now hit Enter. See what I mean.
UDP is much slower then SYN scan or TCP scan, because the destination system does not respond in most
of the time.
Nmap has to wait more to decide the states.
Moreover, we used version detection, which sends more packets to understand the service and the version.
So, this scan takes much longer than the SYN or TCP scans.
One IP address and 10 ports scanned in about 100 seconds!
Wake up if you took a nap! Here are the states of top 10 UDP ports of Metasploitable. Ports
Ports 53 and 137 are flagged as open because they returned UDP responses. And you see the version of the
services listening to that ports. Port 138 is flagged as open|filtered, because there is no response.
And the other ports are flagged as closed because they were turned ICMP port unreachable error.
Let's see how nmap interprets the results of a UDP scan.
Occasionally, a service will respond with a UDP packet proving that it is open.
If an ICMP port unreachable error (type 3, code 3) is returned, the port is closed.
Other ICMP unreachable errors
type 3, codes 0, 1, 2, 9, 10, or 13 mark
The port as filtered. If no response is received after retransmissions, the port is classified as open
or filtered.