2

What command can I use to port scan UDP? I hear that UDP scanning has some specific issues, that do not apply to TCP scanning.

I tried running sudo nmap -p0-65535 -sU 192.168.1.97. But it has been running for a while now without showing any results...

Background information

I noticed that when I use nmap 192.168.0.97 to port-scan my computer, it only lists TCP ports.

For both TCP and UDP ports, I would start by asking the OS on my computer. I.e. How do I list all sockets which are open to remote machines?

But port scanning is still useful as a confirmation. Port scanning your computer from a different computer is a particularly good idea if you have set up a firewall, to confirm that the firewall is doing what you want. In contrast, ss -l and netstat -l will report listening sockets without regard to any local firewall.

Improve this question
0

3 Answers 3

Reset to default
1

That is one of the issues that might apply to UDP scanning. To be honest I have not bothered much with it. I think you can bump up the timing when you are on your nice fast local wired network. The -T5 option seems to work OK when I am scanning the same computer I run nmap on :-). In this case, it completed a full UDP scan in less than 3 minutes.

Another hint: press enter while nmap is running. It will show a progress indicator.

Another way to speed it up is to not scan all 65535 ports :-). If you only want to double-check that your firewall protects the ports you think it does, you can just pass a list of listening ports that you saw in netstat -l / ss -l. I do not tend to have many weird network services that are listening on physical interfaces but that I need to firewall, so I can just type them in manually :-P.

A second issue is that UDP scans may also show programs which are not listening, only making requests, e.g. a program which sent a DNS request and is waiting for a reply. So some judgement is required. This is easiest when using netstat -l -p / ss -l -p so they show the program name, and then you can start guessing how they are using UDP :-).

The paranoia value of a real scan from a different computer, is that it would help people start noticing things like the Intel ME stupidity.

Improve this answer
6
  • Thanks. How would you extract tcp and udp ports from ss or netstat, and pass them to nmap for tcp and udp scan? It is not easy to write such a shell script. Commented Mar 22, 2019 at 23:21
  • @Tim I added a sentence saying that I would not need to. I would follow rules similar to those in the "Omitting localhost" section, then I have only a few services that would show up, so I can type them in manually. If possible, I would tend to configure services to listen on localhost, then I don't have to worry about the firewall for that service. Do you have many services which are not listening on localhost, for some reason? Commented Mar 22, 2019 at 23:24
  • Thanks. (1) I am not sure what rules in the "Omitting localhost" section in unix.stackexchange.com/questions/309083/…, probably because I don't quite follow the post and your reply there. (2) " If possible, I would tend to configure services to listen on localhost". When is it not possible? Commented Mar 22, 2019 at 23:49
  • @Tim memory says that ntpd did not let you actually configure it to listen on localhost. Instead you could only configure ntpd to discard packets which did not come from localhost. My memory might be wrong, but at least that was a common default configuration. googleprojectzero.blogspot.com/2015/01/… Commented Mar 23, 2019 at 0:07
  • @Tim " Access to private and control mode queries can be restricted in ntp.conf based on the source IP. Default installations usually prohibit these queries for every source IP except for 127.0.0.1 and ::1. This is what e.g. Ubuntu, Debian and OS X do [did?]." - this is ntpd checking the source address of each connection itself. It was not being bound to localhost. Commented Mar 23, 2019 at 0:10
0 
sudo nmap -sU --data-length=0 192.168.1.97

The –data-length option can be used to send a fixed-length random payload to every port or (if you specify a value of 0) to disable payloads. If an ICMP port unreachable error (type 3, code 3) is returned, the port is closed. Other ICMP unreachable errors (type 3, codes 1, 2, 9, 10, or 13) mark the port as filtered. Occasionally, a service will respond with a UDP packet, proving that it is open. If no response is received after retransmissions, the port is classified as open|filtered.

Improve this answer
2
  • P.S. in my case any of these commands takes a couple of seconds. Maybe there's some misconfiguration in your case. Commented Aug 17, 2019 at 10:44
  • It looks like the default is --top-scan 1000. Tim was deliberately scanning all 65536 ports, because he did not want to miss anything. It might take 65x as long... Commented Aug 17, 2019 at 13:09
0

sudo nmap -sU -v 192.168.0.97

activate nmap verbose mode. this will work.

Improve this answer

You must log in to answer this question.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.