312-50V9 · Question #503
What are two things that are possible when scanning UDP ports? (Choose two)
The correct answer is B. An ICMP message will be returned E. Nothing. UDP is connectionless, so a closed port typically returns an ICMP Port Unreachable message while an open port may return nothing at all.
Question
What are two things that are possible when scanning UDP ports? (Choose two)
Options
- AA reset will be returned
- BAn ICMP message will be returned
- CThe four-way handshake will not be completed
- DAn RFC 1294 message will be returned
- ENothing
How the community answered
(43 responses)- B93% (40)
- C5% (2)
- D2% (1)
Why each option
UDP is connectionless, so a closed port typically returns an ICMP Port Unreachable message while an open port may return nothing at all.
A TCP RST (reset) packet is a TCP-layer response and is never generated in response to a UDP scan.
When a UDP packet is sent to a closed port, the target host responds with an ICMP Type 3 Code 3 (Port Unreachable) message, indicating no service is listening.
The four-way handshake (TCP FIN sequence) is specific to TCP connection teardown and has no relevance to the connectionless UDP protocol.
RFC 1294 defines Multiprotocol Interconnect over Frame Relay and has no relationship to UDP port scan responses.
When a UDP packet reaches an open port with a listening service, the service may not respond at all if it does not recognize the probe payload, resulting in no response - which scanners interpret as open or filtered.
Concept tested: UDP port scanning behavior and responses
Source: https://nmap.org/book/scan-methods-udp-scan.html
Topics
Community Discussion
No community discussion yet for this question.