9.1.4 UDP Scanning
← Reference index · Previous: Service identification · Next: Results and next actions | Strategy map | Study methods: Discover attack surfaces
Purpose: Sample UDP separately, preserve ambiguous states, and expand only when the objective or evidence warrants it.
9.1.4.1 Check UDP separately
sudo nmap -sU -n --top-ports 20 -oA scans/udp-top20 TARGET
Limit: this is a sample.
open|filteredremains inconclusive; expand when evidence or the objective warrants it.
9.1.4.1.1 Variants — larger sample, selected ports, application probes and TCP + UDP
9.1.4.1.2 Common-port samples
Expand to 100 common ports when more coverage is warranted:
sudo nmap -sU -n --top-ports 100 -oA scans/udp-top100 TARGET
These are samples. open|filtered is inconclusive; TCP results cannot fill UDP gaps.
9.1.4.1.3 Selected ports
Check a relevant UDP port/list:
sudo nmap -sU -n -p PORTS -oA scans/udp-selected TARGET
Add application probes to resolve a useful candidate:
sudo nmap -sU -n -sV -p PORTS -oA scans/udp-detail TARGET
A reply can resolve ambiguity; no reply can leave it inconclusive. If discovery skips an assigned running host, add -Pn with the same limitations as TCP.
9.1.4.1.4 Full UDP coverage when the objective justifies the cost
sudo nmap -sU -n -p- --stats-every 60s -oA scans/udp-all TARGET
This selects UDP ports 1-65535 and may take a long time because silence requires waiting and ICMP errors may be rate-limited. It is the coverage-expansion option, not a universal first command. Continue service work in parallel and preserve the result if the scan cannot finish.
9.1.4.1.5 Combined TCP/UDP selection
Example selection: change the TCP (T:) and UDP (U:) lists for the actual question.
sudo nmap -sS -sU -n -p T:22,80,445,U:53,123,161 -oA scans/tcp-udp TARGET
The port lists are examples, not complete coverage. UDP waiting can extend the combined scan.