Nmap Scan Techniques - UDP, SCTP

Back to the Nmap help.

And we're looking at scan techniques and we're looking at, in, particularly at the UDP scan, the -S -U scan now.

So if we click over here, we can see an example of a scan here Nmap, and then the IP address, then the -S -U, and then we're adding in verbose.

That's plus return on that one.

Most interesting services actually run on TCP, not on UDP, but some worthy of note do run on UDP.

Like you've got DNS on port 53.

You've got SNMP on 1 61 and 1 62.

And he got DHCP on port 67 and 68.

And we can see here, we've got some open ports.

We've got one on 1, 3, 7, and we've got one on 5, 3, 5, 3, and then we've got a bunch of these open filtered UDP scanning is generally slower and more difficult than TCP scanning or SYN scanning.

Bo exploitable UDP services can be found. So UDP shouldn't be forgotten, completely open filtered.

We've already discussed that.

So remember that's when N map is unable to determine whether a port is opened or filtered this occurs when open ports give no response.

So Nmap doesn't know for sure whether the port is open or being filtered, you can combine UDP scans with another type of scan.

So if we just clear this here, and then if we add here -S capital S so that means we're going to have a UDP scan and a TCP scan.

And here we can see the TCP ports, quite a few of them, uh, the UDP ports as well.

UDP scans work by sending a UDP packet to every targeted port, but for some common ports, such as port 53 and 161 a protocol specific payload is sent to increase responsible.

But for most ports, the packet is empty.

That is sent occasionally a service will respond where there UDP packet, proving that it is open.

As we can see on these, as examples is 1, 3 7, and this 53 53.

But if no response is received after retransmission, the port is classified as open filtered.

As you can see here, which as I said means that the port could be open or perhaps there's packet filtering is blocking the communication.

Now what we can do to try and determine whether or not their paws are truly open or not, or filtered is we can add minus S minus capital V.

Now that is version detection.

This also more data to the UDP ports in order to determine version information about those ports now, because this is UDP.

This is going to take a little bit of time, or certainly longer than the previous scan.

A big challenge, with UDP scanning is doing it quickly, open and filtered ports, rarely send any response, leaving Nmap to time out and then conduct retransmissions just in case the probe or response will lost close ports are often an even bigger problem.

They usually send back and ICMP port on reachable error, but unlike the reset package, Sent by close TCP ports and response to a SYN or connect scan, many hosts rate limit ICMP port on reachable messages by default Linux and Solaris are particularly strict about this.

For example, the Linux 4.2 kernel limits, destination and reasonable messages to one per second.

Nmap to tax rate, limiting and slows down.

According to avoid flooding the network with useless packets that the target machine will drop. Anyway.

Unfortunately, a Linux style limit of one packet per second makes a full port scanner of 65,536 ports that will take around 18 hours to scan.

So ideas for speeding up your UDP scan, they can include scanning more hosts in parallel doing a quick scan of just popular ports, first scanning from behind a firewall and using the minus minus host minus time out to skip slow hosts.

And as we can see, that is just finished now.

So you can see that took a little bit of time.

And let me give you an example of what I was talking about.

So if we have on a smiles host dash dash host dash timeout, and then I've got two M two standing for minutes here.

So what will happen there is it won't waste more than two minutes on a single host.

That's going to do the same thing again, but it will time out if it goes over two minutes.

And we're going to cover more on timing later.

So that's UDP UDP scanning is generally slow, as I've said, and it's more difficult than TCP scanning.

Exploitable UDP services can be found.

So UDP shouldn't be forgotten though.

Let's bring an end to this scan.

Let's hop back to the help.

And we see here, we've got the SCTP scans.

We've got the in it, and we've got the cookie echo, so we can see S capital while S capital Z.

So this is a stream control transmission protocol.

It's an alternative to TCP and UDP protocols, and it's mostly used for SS7 sick ran related services.

So I think mobile cellular networks.

So unless you're working on one of those networks, then essentially you're not finding anything on SCTP.

So if I were on this now, it's not going to find anything at all. And there we go.