nmap -sU: scan UDP ports (DNS, SNMP, DHCP)
- tool
- Nmap
- versions
- Nmap 7.x
- os
- linux, macos, windows
sudo nmap -sU 192.0.2.10 scans the 1,000 most common UDP ports of a host. UDP services such as DNS (53), DHCP (67/68), NTP (123) and SNMP (161) do not show up in a normal TCP scan. Because closed UDP ports are slow to detect, limit the ports: sudo nmap -sU -p 53,123,161 192.0.2.10 or --top-ports 100. Scan only hosts you own or are authorised to test.
sudo nmap -sU -p 53,67,123,161 192.0.2.10 # specific UDP ports
sudo nmap -sU --top-ports 100 192.0.2.10 # the 100 most common UDP ports
sudo nmap -sU -sV -p 53,161 192.0.2.10 # tell open from open|filtered
sudo nmap -sS -sU -p T:22,80,443,U:53,161 192.0.2.10 # TCP and UDP in one run
sudo nmap -sU --top-ports 50 --host-timeout 5m 192.0.2.0/24Port states in a UDP scan
| State | What Nmap received |
|---|---|
| open | A UDP reply from the service. |
| closed | ICMP port unreachable (type 3, code 3). |
| filtered | Another ICMP unreachable error (type 3, codes 0, 1, 2, 9, 10 or 13), usually from a firewall. |
| open|filtered | Nothing, even after retransmissions: open but silent, or dropped by a filter. |
For ports such as 53 and 161, Nmap sends a protocol-specific payload to make the service answer; most other ports get an empty packet unless you add --data, --data-string or --data-length.
Making it faster
- Fewer ports.
--top-ports 100or an explicit-p U:...list covers the services that matter in minutes rather than hours. - Several hosts at once. Rate limits apply per target, so scanning many hosts in parallel uses the time better than one host with all ports.
- Timeouts.
--host-timeout 10mskips hosts that would take too long;-T4shortens timeouts on reliable networks. - Version detection selectively.
-sVresolves open|filtered results but sends many probes; use it on the ports you care about.
Pitfalls
- Privileges. Without root Nmap prints
You requested a scan type which requires root privileges. QUITTING!, explained in scan type requires root privileges. - Port syntax. In a combined scan,
-p 53means TCP and UDP 53; use theT:andU:prefixes to target each protocol, as in the port specification guide. - Local checks. To see UDP ports open on your own Linux machine,
ss -ulpnreads the socket table directly and needs no scan.
FAQ
Why are most UDP ports open|filtered?
An open UDP service often sends no reply to an empty or unexpected packet, and a firewall that drops packets also sends nothing. Nmap cannot tell the two apart without a response, so it reports open|filtered. Version detection with -sV sends service-specific probes that make open services answer.
Why is a UDP scan so slow?
Closed ports are detected by ICMP port unreachable messages, and many systems rate-limit them; Linux traditionally sends about one per second. Nmap detects the limit and slows down, so all 65,535 ports can take many hours. Scan the top ports first and use --host-timeout to give up on slow hosts.
Can I scan UDP without root?
No. UDP scanning sends raw packets and reads ICMP replies, which needs root on Linux and macOS or Administrator rights with Npcap on Windows.