312-50V10 · Question #610
What are two things that are possible when scanning UDP ports? (Choose two)
The correct answer is B. An ICMP message will be returned E. Nothing. UDP port scanning is connectionless, so responses differ from TCP - closed UDP ports typically return an ICMP unreachable message, while open ports often return nothing at all.
Question
What are two things that are possible when scanning UDP ports? (Choose two)
Options
- AA reset will be returned
- BAn ICMP message will be returned
- CThe four-way handshake will not be completed
- DAn RFC 1294 message will be returned
- ENothing
How the community answered
(44 responses)- A7% (3)
- B75% (33)
- C14% (6)
- D5% (2)
Why each option
UDP port scanning is connectionless, so responses differ from TCP - closed UDP ports typically return an ICMP unreachable message, while open ports often return nothing at all.
A TCP RST (reset) is a TCP-specific flag used to abruptly terminate a connection; UDP is connectionless and has no equivalent reset mechanism.
When a UDP port is closed, the target host responds with an ICMP Type 3 (Destination Unreachable) Code 3 (Port Unreachable) message per RFC 792. This ICMP error is the standard kernel-level response for closed UDP ports and allows a scanner to infer the port state. No application-layer reply is involved.
The four-way handshake is a TCP connection-termination sequence and has no relevance to the connectionless UDP protocol.
RFC 1294 defines multiprotocol interconnect over Frame Relay and has no relationship to UDP port scanning or ICMP responses.
When a UDP port is open, the listening application frequently discards unrecognized UDP payloads without sending any reply. This silence is the expected behavior for open or filtered UDP ports, making a non-response an ambiguous but valid scan outcome. No TCP-style acknowledgment or ICMP error is generated in this case.
Concept tested: UDP port scan response behavior and ICMP unreachable
Source: https://nmap.org/book/scan-methods-udp-scan.html
Topics
Community Discussion
No community discussion yet for this question.