What command can I use to port scan UDP? I hear that UDP scanning has some specific issues, that do not apply to TCP scanning.

I tried running sudo nmap -p0-65535 -sU But it has been running for a while now without showing any results...

Background information

I noticed that when I use nmap to port-scan my computer, it only lists TCP ports.

For both TCP and UDP ports, I would start by asking the OS on my computer. I.e. How do I list all sockets which are open to remote machines?

But port scanning is still useful as a confirmation. Port scanning your computer from a different computer is a particularly good idea if you have set up a firewall, to confirm that the firewall is doing what you want. In contrast, ss -l and netstat -l will report listening sockets without regard to any local firewall.


That is one of the issues that might apply to UDP scanning. To be honest I have not bothered much with it. I think you can bump up the timing when you are on your nice fast local wired network. The -T5 option seems to work OK when I am scanning the same computer I run nmap on :-). In this case, it completed a full UDP scan in less than 3 minutes.

Another hint: press enter while nmap is running. It will show a progress indicator.

Another way to speed it up is to not scan all 65535 ports :-). If you only want to double-check that your firewall protects the ports you think it does, you can just pass a list of listening ports that you saw in netstat -l / ss -l. I do not tend to have many weird network services that are listening on physical interfaces but that I need to firewall, so I can just type them in manually :-P.

A second issue is that UDP scans may also show programs which are not listening, only making requests, e.g. a program which sent a DNS request and is waiting for a reply. So some judgement is required. This is easiest when using netstat -l -p / ss -l -p so they show the program name, and then you can start guessing how they are using UDP :-).

The paranoia value of a real scan from a different computer, is that it would help people start noticing things like the Intel ME stupidity.

  • Thanks. How would you extract tcp and udp ports from ss or netstat, and pass them to nmap for tcp and udp scan? It is not easy to write such a shell script. – Tim Mar 22 '19 at 23:21
  • @Tim I added a sentence saying that I would not need to. I would follow rules similar to those in the "Omitting localhost" section, then I have only a few services that would show up, so I can type them in manually. If possible, I would tend to configure services to listen on localhost, then I don't have to worry about the firewall for that service. Do you have many services which are not listening on localhost, for some reason? – sourcejedi Mar 22 '19 at 23:24
  • Thanks. (1) I am not sure what rules in the "Omitting localhost" section in unix.stackexchange.com/questions/309083/…, probably because I don't quite follow the post and your reply there. (2) " If possible, I would tend to configure services to listen on localhost". When is it not possible? – Tim Mar 22 '19 at 23:49
  • @Tim memory says that ntpd did not let you actually configure it to listen on localhost. Instead you could only configure ntpd to discard packets which did not come from localhost. My memory might be wrong, but at least that was a common default configuration. googleprojectzero.blogspot.com/2015/01/… – sourcejedi Mar 23 '19 at 0:07
  • @Tim " Access to private and control mode queries can be restricted in ntp.conf based on the source IP. Default installations usually prohibit these queries for every source IP except for and ::1. This is what e.g. Ubuntu, Debian and OS X do [did?]." - this is ntpd checking the source address of each connection itself. It was not being bound to localhost. – sourcejedi Mar 23 '19 at 0:10
sudo nmap -sU --data-length=0

The –data-length option can be used to send a fixed-length random payload to every port or (if you specify a value of 0) to disable payloads. If an ICMP port unreachable error (type 3, code 3) is returned, the port is closed. Other ICMP unreachable errors (type 3, codes 1, 2, 9, 10, or 13) mark the port as filtered. Occasionally, a service will respond with a UDP packet, proving that it is open. If no response is received after retransmissions, the port is classified as open|filtered.

  • P.S. in my case any of these commands takes a couple of seconds. Maybe there's some misconfiguration in your case. – JoKeR Aug 17 '19 at 10:44
  • It looks like the default is --top-scan 1000. Tim was deliberately scanning all 65536 ports, because he did not want to miss anything. It might take 65x as long... – sourcejedi Aug 17 '19 at 13:09

sudo nmap -sU -v

activate nmap verbose mode. this will work.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.