TCP vs. UDP Scanning with Nmap

1. TCP vs. UDP: The Fundamental Difference

Before we can understand how to scan for UDP services, we must first solidify our understanding of the difference between the two protocols. In the previous lesson, we saw that TCP is connection-oriented. It establishes a reliable, ordered conversation using the three-way handshake, much like making a phone call where both parties confirm they are ready to talk before speaking.

UDP, or User Datagram Protocol, is the opposite. It is connectionless. It sends packets (datagrams) without establishing a prior connection and without any guarantee of delivery or order. Think of it like sending a series of postcards; you send them one by one, but you don't know if they all arrived, or in what order.

This difference is visualized perfectly in the diagram below. TCP has a formal setup process, while UDP just sends the data.

This "fire-and-forget" nature of UDP is why we need a completely different scanning strategy. We can't look for SYN/ACK packets because they don't exist in the UDP world.

2. The Logic of a UDP Scan

So, if there's no handshake, how does Nmap figure out if a UDP port is open? It relies on the response—or lack thereof—to a UDP packet sent to the target port.

Here’s the logic Nmap follows:

1. Nmap sends a UDP packet to a target port. This packet is usually empty.
2. Nmap waits for a response. The outcome determines the port's state.

This next video from HackerSploit explains the process clearly.

To summarize and expand on the video, here are the possible scenarios:

• Port is closed: The target's operating system sends back an ICMP "Port Unreachable" message (Type 3, Code 3). This is a definitive sign the port is closed.
• Port is open: In most cases, the service listening on the port will simply receive the empty UDP packet, not know what to do with it, and discard it. It sends no response.
• Port is filtered: A firewall or other filtering device may block the UDP packet from reaching the port. It may also send back other ICMP error messages (like "Administratively Prohibited"). Like an open port, a filtered port often results in no response.

This leads to the biggest challenge in UDP scanning: when Nmap gets no response, it can't distinguish between a port that is open and one that is filtered. Therefore, it labels the port as open|filtered.

The image below illustrates these possibilities.

3. Performing and Optimizing UDP Scans (-sU)

The Nmap option to perform a UDP scan is -sU. Since this involves crafting raw packets and listening for ICMP responses, it generally requires root privileges.

A basic UDP scan command looks like this:
sudo nmap -sU <target_IP>

However, if you run this, you'll immediately notice two things:

1. It is extremely slow. Because Nmap has to wait for a timeout for every open|filtered port, a scan of the default 1000 ports can take many minutes, and a full 65,536-port scan can take over 18 hours! This is often due to operating systems rate-limiting the ICMP "port unreachable" messages they send.
2. Most results are open|filtered, which isn't very helpful.

Fortunately, Nmap provides powerful options to overcome these challenges. Let's turn to the official Nmap documentation to understand them.

From that reading, here are the two most important strategies for effective UDP scanning:

1. Clarify Results with Version Detection (-sV): When you add -sV to your scan, Nmap doesn't just send an empty UDP packet. For open|filtered ports, it sends protocol-specific probes (e.g., a valid DNS query to port 53). If the service responds, Nmap knows the port is truly open and can often identify the service and version.
2. Increase Speed with -F: The -F (Fast) flag tells Nmap to scan only the top 100 most common ports instead of the default 1000. This dramatically reduces scan time and is a great first step.

Combining these gives you a much more effective command: sudo nmap -sU -sV -F <target_IP>.

4. Hands-On Lab: Scanning Metasploitable2 for UDP Services

Time to apply this in your lab. Ensure your Kali and Metasploitable2 VMs are running.

1. Find your target's IP if you don't already have it.
2. Run a Basic (and Slow) UDP Scan:
   • In your Kali terminal, run: sudo nmap -sU <metasploitable_IP>
   • Do not wait for this to finish. Let it run for a minute to see how slowly it progresses, then press Ctrl+C to cancel it. This demonstrates the speed problem firsthand.
3. Run a Fast Scan:
   • Now, let's add the -F flag to scan only the top 100 ports: sudo nmap -sU -F <metasploitable_IP>
   • This will complete much faster. Observe the output. You will likely see several ports listed as open|filtered. For example, you should see port 53 (domain), 67 (dhcps), and 111 (rpcbind).
4. Run an Effective Scan to Get Definitive Results:
   • Now, let's add version detection to clarify those open|filtered results.
   • Run the command: sudo nmap -sU -sV -F <metasploitable_IP>
   • Compare the output. You should now see that Nmap has confirmed that port 53 is open and is running a BIND DNS server, and port 111 is open and running rpcbind. This is actionable intelligence! Port 67 might remain open|filtered because Nmap's default probes didn't get a response, but you've still narrowed down your targets significantly.
5. (Optional) Combining Scan Types:
   • You can scan for both TCP and UDP ports in a single command. This is very efficient.
   • Try this command to scan for TCP port 22 (SSH) and UDP port 53 (DNS): sudo nmap -sS -sU -p T:22,U:53 <metasploitable_IP>
   • The -p flag lets you specify ports, and T: and U: prefix the port numbers to define the protocol.

Conclusion

You have now added another essential tool to your reconnaissance toolkit. While more complex and time-consuming than TCP scanning, UDP scanning is non-negotiable for a thorough penetration test.

Key Takeaways:

• TCP is connection-oriented; UDP is connectionless. This fundamental difference dictates the scanning methodology.
• UDP scanning relies on ICMP "port unreachable" messages to identify closed ports. A lack of response results in an ambiguous open|filtered state.
• A basic UDP scan (-sU) is very slow.
• To perform an effective UDP scan, combine flags:
  • Use -sV (Version Detection) to send protocol-specific probes that turn open|filtered results into confirmed open ports.
  • Use -F (Fast Scan) to limit the scan to the 100 most common ports for a quick assessment.

Next Lesson Preview:
So far, you have learned to find open TCP and UDP ports. You've mapped the attack surface. The next logical step is to enumerate these services—to interact with them and learn everything you can about their configuration. In the next lesson, we will begin this process by focusing on a very common and often vulnerable service: SMB (Server Message Block). You will learn to use tools like enum4linux-ng to discover shares, users, and system information, taking your first step from scanning into active enumeration.