Feb 01,2010

NMAP 5.21 – Is UDP Protocol Specific Scanning Important? Why Should I Care?, (Mon, Feb 1st)

Before we address the question, let's discuss how UDP port scanning is typically done. When a host receives a UDP packet, what is supposed to happen is that if the host isn't listening on that port, it should reply with a ICMPPort Unreachable (ICMPType 3, Code 3). If it is listening on that port, the packet contents are fed to the listening application and processed. If the application does not understand the packet contents, it might reply with an error, but most likely will drop the packet and not reply at all. If there is any kind of a firewall involved, either ...

Filed Under: SANS Internet Storm Center, Tags: , ,

Leave a Reply