Probe UDP and resolve ambiguous silence

Needs: Raw-packet access and UDP reachability from the real source; bounded or full selection must be explicit

5. Check UDP separately

Purpose: Sample UDP separately, preserve ambiguous states, and expand only when the objective or evidence warrants it.

# 5. Check UDP separately
sudo nmap -sU -n --top-ports 20 -oA scans/udp-top20 TARGET

# Expand to 100 common ports when more coverage is warranted
sudo nmap -sU -n --top-ports 100 -oA scans/udp-top100 TARGET

# Check a relevant UDP port/list
sudo nmap -sU -n -p PORTS -oA scans/udp-selected TARGET

# Add application probes to resolve a useful candidate
sudo nmap -sU -n -sV -p PORTS -oA scans/udp-detail TARGET

# Full UDP coverage when the objective justifies the cost
sudo nmap -sU -n -p- --stats-every 60s -oA scans/udp-all TARGET

# Combined TCP/UDP selection
sudo nmap -sS -sU -n -p T:22,80,445,U:53,123,161 -oA scans/tcp-udp TARGET

This selects UDP ports 1-65535 and may take a long time because silence requires waiting and ICMP errors may be rate-limited. It is the coverage-expansion option, not a universal first command. Continue service work in parallel and preserve the result if the scan cannot finish.

Verify → Use an application response for a confirmed service; document unresolved silence, coverage and ICMP rate-limit effects.

If it fails → Do not translate UDP silence into a closed service. Retry a focused application-aware probe or a different permitted vantage point. More detail ↓

If → then

UDP/161 evidence or an exposed management plane → Extract configuration and process information through SNMP
Needs: An accepted read community or SNMPv3 identity/security level; transport and view permissions
A DNS server, domain name or host aliases → Expand names through DNS records and zone transfers
Needs: Reachable DNS transport and relevant authoritative zone; AXFR requires an allowed TCP zone transfer
RPC/NFS listeners or export information → Inspect RPC/NFS exports and effective file identity
Needs: Reachable RPC/NFS transports, permitted client address and an export whose UID/GID mapping grants relevant access

No useful finding → another task in this topic. Failed check → resolve the failure before ruling out the path.

Explanation & examples

Probe UDP and resolve ambiguous silence

USE WHEN: TCP enumeration is incomplete for the objective or DNS/SNMP/RPC clues suggest UDP
STARTING ACCESS: An explicitly assigned address or host list and a known source position
RESULT: UDP responders and documented open/filtered uncertainty

Recognize the clue

Inspect discovery results and DNS/SNMP/RPC clues, then probe a separate bounded UDP selection from the same source.

sudo nmap -Pn -sU --top-ports 20 --reason TARGET -oA udp-initial

SYNTHETIC EXAMPLE OUTPUT

161/udp open|filtered snmp no-response
53/udp open domain udp-response

Means: A DNS response confirms a UDP application; open|filtered SNMP silence is a candidate requiring a correctly formatted request.

Confirm: Check accepted service parameters, response identity and possible ICMP rate limiting.

After validation: A service-native request returns the expected OID/record: enumerate that application.
Ruled out in this context: An explicit port-unreachable response rules out that UDP endpoint for this source/time.
Still inconclusive: Silence can mean open or filtered; use a justified application-aware probe rather than declaring either.

Troubleshooting: Do not translate UDP silence into a closed service. Retry a focused application-aware probe or a different permitted vantage point.

Additional prerequisite checks

sudo nmap -Pn -sU --top-ports 20 --reason TARGET -oA udp-initial
sudo nmap -Pn -sU -sV -p 53,161 TARGET -oA udp-focused

Purpose: Sample UDP separately, preserve ambiguous states, and expand only when the objective or evidence warrants it.

5. Check UDP separately

Limit: this is a sample. open|filtered remains inconclusive; expand when evidence or the objective warrants it.

Variants — larger sample, selected ports, application probes and TCP + UDP

Common-port samples

Expand to 100 common ports when more coverage is warranted:

These are samples. open|filtered is inconclusive; TCP results cannot fill UDP gaps.

Selected ports

Check a relevant UDP port/list:

Add application probes to resolve a useful candidate:

A reply can resolve ambiguity; no reply can leave it inconclusive. If discovery skips an assigned running host, add -Pn with the same limitations as TCP.

Full UDP coverage when the objective justifies the cost

This selects UDP ports 1-65535 and may take a long time because silence requires waiting and ICMP errors may be rate-limited. It is the coverage-expansion option, not a universal first command. Continue service work in parallel and preserve the result if the scan cannot finish.

Combined TCP/UDP selection

Example selection: change the TCP (T:) and UDP (U:) lists for the actual question.

The port lists are examples, not complete coverage. UDP waiting can extend the combined scan.

Why it works

A UDP service may ignore an empty probe; ICMP errors and application responses distinguish states. Silence alone cannot distinguish open from filtered.

Worked example · hypothetical

Observation: UDP/161 is open|filtered. Test: a correctly formatted SNMP request with a justified community. Illustrative output: system OIDs return. Interpretation: SNMP is confirmed accessible; enumerate useful branches.

New identity, privilege, host or route? Re-enumerate → All topic tasks →

Study guide ↗Full procedure ↗Cheatsheet ↗