A tester runs `nmap -sU -p 53,161,500 10.10.10.5` and the scan reports all three ports as open|filtered. Which statement best explains this result and the appropriate next step?
- AThe ports are definitively closed since no ICMP port-unreachable message was returned
- BThe ports are confirmed open because UDP never returns a closed-port response
- CThe host is completely unreachable, so the scan results should be discarded entirely
- DNmap could not distinguish between an open port and one blocked by a firewall because no response was received; the tester should send protocol-specific probes to confirm the actual state
Show answer & explanationAnswer & explanation
Correct answer: D. Nmap could not distinguish between an open port and one blocked by a firewall because no response was received; the tester should send protocol-specific probes to confirm the actual state
With UDP scanning, Nmap marks a port as open|filtered when no response is received, because both an open UDP service that simply doesn't reply and a firewall silently dropping the packet look identical from the scanner's perspective. To resolve the ambiguity, the tester should send protocol-specific probes (e.g., DNS queries for port 53, SNMP requests for port 161) or use -sV for UDP version detection.
Why the other options are wrong
- A. Closed UDP ports return an ICMP port-unreachable message; absence of any response does not confirm closed status.
- B. UDP scans lack a definitive open-confirmation response; silence is ambiguous, not confirmation of open.
- C. Other hosts/ports may still be reachable; ambiguity on UDP ports doesn't mean the whole host is unreachable.
Nmap UDP Scan Port States
UDP scanning in Nmap often yields 'open|filtered' because Nmap cannot distinguish a silently open UDP service from one blocked by a firewall due to the connectionless nature of UDP.
- ICMP port-unreachable = closed
- No response = open|filtered (ambiguous)
- Protocol-specific probes or -sV help resolve ambiguity
Memory trick: Silence in UDP land means 'maybe open, maybe blocked' — you must ask again