Nmap ZenMap Switches Practice Test

UDP scanning probes UDP ports because UDP is a connectionless protocol with no handshake. When you use the UDP scan switch, Nmap sends UDP packets to target ports and waits for responses. If a port replies with a UDP payload, it’s likely open. If you receive an ICMP Port Unreachable message, the port is closed. If there is no reply, the port is usually considered open|filtered, since a firewall or filtering device might be dropping the packets. This approach tends to be slower and noisier than TCP scans, and many hosts filter or rate-limit UDP traffic. Other common scanning methods target TCP behavior: one uses a SYN packet to elicit a half-open handshake, another attempts a full TCP connect, and another analyzes responses to ACK probes to infer firewall rules. The UDP switch is the appropriate choice when you specifically need to assess UDP ports.