You can prove a UDP port isn't open: you send out a packet and the operating system returns a suitable "unreachable" ICMP message. You can prove that a UDP port is open: you send out a packet and get a data packet in return.
The problem with UDP lies in the case where you send out a packet and nothing happens. Is a firewall dropping the packets? Is the port open, and you just haven't figured out how to get a response? Are you having bad luck with network congestion? Since UDP is connectionless, you can't tell these cases apart.
Power management, mobile and firmware developer on Linux. Security developer at Aurora. Ex-biologist. mjg59 on Twitter. Content here should not be interpreted as the opinion of my employer. Also on Mastodon.
![[personal profile]](https://www.dreamwidth.org/img/silk/identity/user.png){kind=small}
Re: Is a port scan good enough?
Date: 2017-05-02 08:42 pm (UTC)The problem with UDP lies in the case where you send out a packet and nothing happens. Is a firewall dropping the packets? Is the port open, and you just haven't figured out how to get a response? Are you having bad luck with network congestion? Since UDP is connectionless, you can't tell these cases apart.