Nmap UDP Scan

UDP (User Datagram Protocol) scan in Nmap is used to identify open UDP ports on a target system. Unlike TCP, UDP is a connectionless protocol, which means that it does not require a three-way handshake to establish a connection. UDP scans in Nmap involve sending UDP packets to target ports and analyzing the responses (if any).

Here's how UDP scan in Nmap works:

1. UDP Scan (-sU):

   • The UDP scan in Nmap is invoked using the -sU option.

   • Nmap sends UDP packets to the specified target ports, typically with empty payloads or payloads designed to elicit a response from the target service.

   • If the target port is closed, the target system typically responds with an ICMP "Port Unreachable" message. Nmap interprets this response as evidence that the port is closed.

   • If the target port is open, the target system may not send any response. This lack of response can make it challenging to distinguish between open and filtered ports, as well as between open and closed ports.

   • The lack of a response can be due to various reasons, including firewalls, filtering devices, or the target system's configuration.

   • UDP scans can be slower and less reliable than TCP scans, as UDP is a connectionless protocol and does not provide the same level of error checking and reliability as TCP.

UDP scans are commonly used to identify services and applications running on UDP ports, such as DNS (Domain Name System), SNMP (Simple Network Management Protocol), DHCP (Dynamic Host Configuration Protocol), and others. However, due to the unreliable nature of UDP and the lack of guaranteed responses, UDP scans may produce less accurate results compared to TCP scans. Therefore, it's important to interpret the results of UDP scans in Nmap with caution and to verify them using additional methods if necessary.

---

State	Description
open	This indicates that the connection to the scanned port has been established. These connections can be TCP connections, UDP datagrams as well as SCTP associations.
closed	When the port is shown as closed, the TCP protocol indicates that the packet we received back contains an RST flag. This scanning method can also be used to determine if our target is alive or not.
filtered	Nmap cannot correctly identify whether the scanned port is open or closed because either no response is returned from the target for the port or we get an error code from the target.
unfiltered	This state of a port only occurs during the TCP-ACK scan and means that the port is accessible, but it cannot be determined whether it is open or closed.
open|filtered	If we do not get a response for a specific port, Nmap will set it to that state. This indicates that a firewall or packet filter may protect the port.
closed|filtered	This state only occurs in the IP ID idle scans and indicates that it was impossible to determine if the scanned port is closed or filtered by a firewall.