‫UDP scan is activated with the upper Kasu option.
‫UDP scan works by sending a UDP packet to every targeted port for some common port, such as the three
‫and one six one a protocol specific payload sent to increase response rate.
‫But for most sports, the packet is empty.
‫Well, there are some options to force and map to send on empty packets, such as data parameter.
‫Because you'd be scanning is generally slower and more difficult than TCP.
‫Some security auditors ignore these pork.
‫Now I think this is a mistake as exploitable UDP services are quite common and attackers certainly don't
‫ignore the whole protocol.
‫So in general, destination systems do not respond when they receive a UDP packet.
‫So when Map doesn't recognize of the port is open or filtered when there is no response from the target
‫system.
‫In this case, the port is flagged as open or filtered to force the systems to respond to our package.
‫You'd be better off using UDP scan with version detection option.
‫You'll have much more accurate results.
‫Let's perform an end map UDP scan in our virtual network.
‫Go to Carly and open a terminal screen.
‫I want to scan my Metasploit system.
‫Let's create the UDP scan command.
‫And map is the command itself and is to avoid the DNS resolution.
‫I like to see the IP addresses uppercase pen is to avoid the host discovery.
‫We've seen this before.
‫S upper case, you is to do the UDP scan.
‫Now here's the target IP address one seven two one six nine nine two zero six.
‫So let's keep it fast scan for the top ten ports only.
‫I use top ports parameter for this purpose.
‫Now, as I said a minute ago, UDP scan should run with version detection use s ever score v parameter
‫to use a version detection.
‫I'd like to add one more parameter here, which is reason reason parameter is used to show the reason
‫why the state of the port is set as open, closed or filter.
‫Now hit enter.
‫See what I mean.
‫UDP is much slower than since scan or TCP scan, because the destination system does not respond in
‫most of the time, and then Map has to wait more to decide the state's.
‫And moreover, we use version detection, which sends more packets to understand the service and the
‫version.
‫So this scan takes much longer than this in or TCP scanned.
‫One IP address and 10 port scanned in about what's at 100 seconds.
‫Wake up if you took a nap.
‫Here are the states of the top 10 UDP ports of Metasploit about.
‫It's five, three and one, three seven our flag as open because they were turned UDP responses and
‫you see the version of the services.
‫Listening to those ports.
‫Port, 138, is flagged as open filtered because there is no response and the other ports are flagged
‫as closed because they were turned ICMP port unreachable areas.
‫Let's see how Nmap interprets the results of a UDP scan.
‫Occasionally, a service will respond with a UDP packet.
‫Proving that it is open.
‫If an export unreachable error type three code three is returned.
‫The port is closed.
‫Other ICMP unreachable errors.
‫Type three, code zero, one, two, nine, 10 or 13.
‫Mark Deport is filtered.
‫If no response is received after retrans missions.
‫The board is classified as open or filtered.