Home > CAPEC List > CAPEC-308: UDP Scan (Version 2.9)  

CAPEC-308: UDP Scan

UDP Scan
Definition in a New Window Definition in a New Window
Attack Pattern ID: 308
Abstraction: Detailed
Status: Draft
Completeness: Stub
Presentation Filter:
+ Summary

An attacker engages in UDP scanning to gather information about UDP port status. UDP scanning methods involve sending a UDP datagram to the target port and looking for evidence that the port is closed. Open UDP ports usually do not respond to UDP datagrams as there is no stateful mechanism within the protocol that requires building or establishing a session. Responses to UDP datagrams are therefore application specific and cannot be relied upon as a method of detecting an open port. UDP scanning relies heavily upon ICMP diagnostic messages in order to determine the status of a remote port. Firewalls or ACLs which block egress ICMP error types effectively prevent UDP scans from returning any useful information. UDP scanning is further complicated by rate limiting mechanisms governing ICMP error messages. During a UDP scan, a datagram is sent to a target port. If an ICMP Type 3 Port unreachable error message is returned then the port is considered closed. Different types of ICMP messages can indicate a filtered port.

  • 1. Speed: UDP scanning is very slow due to ICMP rate limiting
  • 2. Stealth: RPC scanning is relatively stealthy provided the sending rate does not trigger IPS/IDS sensors
  • 3. Open Port: Infers an open port based on no response, or an occasional response by a well-known service
  • 4. Closed Port: Detects a closed port using return ICMP diagnostic messages from the host
  • 5. Filtered Port: Can detect some filtered ports via ICMP diagnostic messages
  • 6. Unfiltered Port: Can detect unfiltered ports based on some ICMP diagnostic messages

The protocol characteristics of UDP make port scanning inherently more difficult than with TCP, as well as dependent upon ICMP for accurate scanning. Due to ambiguities that can arise between open ports and filtered ports, UDP scanning results often require a high degree of interpretation and further testing to refine. In general, UDP scanning results are less reliable or accurate than TCP-based scanning.

+ Target Attack Surface

Target Attack Surface Description

Targeted OSI Layers: Network Layer

Target Attack Surface Localities


Target Attack Surface Types: Host Service

+ Attack Prerequisites
  • The ability to send UDP datagrams to a host and receive ICMP error messages from that host. In cases where particular types of ICMP messaging is disallowed, the reliability of UDP scanning drops off sharply.

+ Typical Severity


+ Resources Required

The ability to craft custom UDP Packets for use during network reconnaissance. This can be accomplished via the use of a port scanner, or via socket manipulation in a programming or scripting language. Packet injection tools are also useful. It is also necessary to trap ICMP diagnostic messages during this process. Depending upon the method used it may be necessary to sniff the network in order to see the response.

+ Attack Motivation-Consequences
ScopeTechnical ImpactNote
"Varies by context"
Bypass protection mechanism
Hide activities
+ References
[R.308.1] [REF-20] Stuart McClure, Joel Scambray and George Kurtz. "Hacking Exposed: Network Security Secrets & Solutions". Chapter 2: Scanning, pg. 54-69. 6th Edition. McGraw Hill. 2009.
[R.308.2] [REF-27] J. Postel. "RFC768 - User Datagram Protocol". August 28, 1980. <http://www.faqs.org/rfcs/rfc768.html>.
[R.308.3] [REF-22] Gordon "Fyodor" Lyon. "Nmap Network Scanning: The Official Nmap Project Guide to Network Discovery and Security Scanning". Section 5.4 RPC Grinding, pg. 101. 3rd "Zero Day" Edition,. Insecure.com LLC, ISBN: 978-0-9799587-1-7. 2008.
[R.308.4] [REF-10] Gordon "Fyodor" Lyon. "The Art of Port Scanning". Volume: 7, Issue. 51. Phrack Magazine. 1997. <http://www.phrack.org/issues.html?issue=51&id=11#article>.
+ Content History
CAPEC Content TeamThe MITRE Corporation2014-06-23Internal_CAPEC_Team

More information is available — Please select a different filter.
Page Last Updated or Reviewed: December 07, 2015