‫UDP scan is activated with the S uppercase U option.
‫UDP scan works by sending a UDP packet to every targeted port for some common port such as 53 and one
‫six one, a protocol specific payload sent to increase response rate.
‫But for most sports, the packet isn't.
‫Well, there are some options to force and map to send non-empty packets such as data parameter.
‫Because UDP scanning is generally slower and more difficult than Tsipi, some security auditors ignore
‫these ports now.
‫I think this is a mistake as exploitable UDP services are quite common and attackers certainly don't
‫ignore the whole protocol.
‫So in general, destination systems do not respond when they receive a UDP packet, so Unmap doesn't
‫recognize if the port is open or filtered when there is no response from the target system.
‫In this case, the port is flagged as open or filtered divorcées systems to respond to our package.
‫You'd be better off using UDP skin with version detection option, you'll have much more accurate results.
‫Let's perform and map UDP scan in our virtual network.
‫Go to Cali and open a terminal scream, I want to scan my medicine voidable system, let's create the
‫UDP scan command.
‫And map is the command itself and is to avoid the DNS resolution.
‫I like to see the IP addresses uppercase p end is to avoid the host discovery.
‫We've seen this before.
‫S Uppercase U is to do the UDP scan.
‫Now here's the target IP address one seven two one six nine nine zero six.
‫So let's keep it fast.
‫Scan for the top 10 ports only.
‫I use top words parameter for this purpose.
‫Now, as I said a minute ago, UDP scan should run with version detection, use of a score of parameter
‫to use a version detection.
‫I'd like to add one more parameter here, which is reason, reason parameter is used to show the reason
‫why the state of the port is set as open, closed or filtered.
‫Now hit enter.
‫See what I mean, UDP is much slower than SoundScan scan or TCP scan because the destination system
‫does not respond in most of the time.
‫And then MAP has to wait more to decide the state's.
‫And moreover, we use version detection, which sends more packets to understand the service and the
‫version.
‫So this can takes much longer than this in or TCP scanned.
‫One IP address and 10 port scanned in about was had 100 seconds, wake up if you took a nap.
‫Here are the states of the top 10 UDP boards of medicine voidable.
‫Four, five, three and one three seven are flagged as open because they were turned UDP responses and
‫you see the version of the services listening to those ports.
‫Bought one three eight is flagged, is open, filtered because there is no response and the other ports
‫are flagged, is closed because they were turned ICMP port unreachable.
‫Let's see how Unmap interprets the results of a UDP scan.
‫Occasionally, a service will respond with a UDP packet.
‫Proving that it is open.
‫If an ICMP port unreachable error, type three, code three is returned.
‫The port is closed.
‫Other ICMP unreachable errors, type three codes zero one two nine, 10 or 13.
‫Mark, the port is filtered.
‫If no response is received after retransmissions.
‫The board is classified as open or filtered.