The -sU option in NMAP is used for UDP (User Datagram Protocol) ports scanning. NMAP is a powerful tool developed by Gordon Lyon for network exploration or security auditing. This command-line tool is beneficial to document networks and identify open ports or different hosts on a network.
The primary function of the -sU option is to perform a UDP scan. TCP protocols are predominantly used for internet communication. However, some applications still use UDP due to its simplicity and low network overhead. This scan can be critical because some servers and applications do not adequately secure their UDP ports because of a misconception that they aren’t as vulnerable as TCP ports.
When using the -sU option, NMAP sends a UDP packet to each targeted port. For most ports, the packet will be empty, i.e., it will bear no payload and will contain only an UDP header. In response to this, if the port is open, no response will come back. However, if the port is closed, an ICMP Port Unreachable message is returned.
One of the issues with this method is that it can take a long time 😊s some systems impose long delays when UDP ports receive unexpected input, to help protect against Denial of Service (DOS) attacks.
An illustrative example of using -sU for a UDP scan on the top 20 ports would look like: `nmap -sU —top-ports 20
It’s important to understand that running this scan may require administrative privileges to be executed effectively. Moreover, as UDP is a stateless protocol, it does not guarantee the delivery of packages. Hence the results of -sU scans are not as reliable as TCP scan results
As a source, I used Gordon Lyon’s book “Nmap Network Scanning: The Official Nmap Project Guide to Network Discovery and Security Scanning.” This comprehensive guide contains detailed descriptions of all the various options and scans that can be performed with NMAP, including the -sU option.
Another source I used was the official NMAP website. It provides a wealth of information about NMAP’s various capabilities, including UDP scanning. It’s a fantastic resource for anyone looking to learn more about this powerful tool.
There is also a great article in the online “(ISC)2 CISSP Certified Information Systems Security Professional Official Study Guide” which discusses in detail the different types of scans that can be used in a security audit, including UDP scans with Nmap’s -sU option.
In conclusion, the -sU option of NMAP provides network administrators and security professionals with a powerful tool to identify potentially vulnerable UDP ports in their network.
Sources:
1. Gordon Fyodor Lyon. Nmap Network Scanning: The Official Nmap Project Guide to Network Discovery and Security Scanning. Insecure, 2009.
2. NMAP Official Site, “Nmap UDP Scan”. https://nmap.org/book/udpscan.html
3. (ISC)2. CISSP Certified Information Systems Security Professional Official Study Guide. Sybex, 2018.
