2

I am doing some research and I need a very quick way to scan for open ports on a single machine. To provide some context, I know that my machine will have a port open waiting for UDP packets for about 3 seconds. That is all I have. I also know that it is in the range of port 50000 to 62000.

Long story short, how can I scan 12000 ports in less than 3 seconds?

I tried to find the answer myself first. I put my hopes in zmap but it seems to work on different IPs, not different ports for a single IP.

I played with nmap with -T5 and --min-parallelism/max-parallelism but it takes minutes to scan those 12k ports.

martinvigo
  • 21
  • 1
  • 5
  • Do you know which service is provided on this UDP port, or at least do you know some string which will make the service to reply? – WhiteWinterWolf Feb 03 '15 at 11:23
  • 1
    Have you tried Unicornscan? It tends to be much faster than nmap for UDP scans. – schroeder Feb 03 '15 at 19:33
  • @GZBK unfortunatelly not. I know is some kind of VOIP service but I suspect it is a privative protocol, not RTP. – martinvigo Feb 03 '15 at 21:03
  • @schroeder I was not aware of that one, will definitely try out. Thanks! – martinvigo Feb 03 '15 at 21:04
  • Use fast ports (e.g., 10GbE, GbE) and either a fast switch backplane (e.g., Cisco Catalyst 6500) or a cross-over cable with `unicornscan 10.0.0.0/24:50000-62000 -L 45 -r 10000 -Iv -mU` – atdre Apr 14 '15 at 21:23

1 Answers1

2

Are you explicitly specifying a UDP scan in nmap (-sU)?

I would be surprised if you can get the time down to 3 seconds. Also be aware that using -T5 can cause issues, such as DoS or inaccurate results.

Also be aware that there is no requirement for UDP ports to reply to your packets, which is why UDP scanning is more difficult than TCP.

Ref: https://nmap.org/book/man-port-scanning-techniques.html

Edited to add: Doing a bit more searching I found this question which has some methods to speed up UDP scans, and their drawbacks.

Community
  • 1
AlexH
  • 1,168
  • 6
  • 8
  • If the host is nice, it will send you an ICMP port unreachable if the UDP port is not listening. – Dog eat cat world Feb 03 '15 at 14:38
  • 2
    @Dogeatcatworld But it will likely rate-limit those responses to 1 per second, so Nmap will slow down accordingly in order to catch them all. This is the major source of UDP slowness in Nmap vs asynchronous scanner that doesn't care about closed ports. – bonsaiviking Feb 03 '15 at 14:41
  • Thanks, I did not know about this. Do you know if this rate limit is set globally, or pr client address? – Dog eat cat world Feb 03 '15 at 14:49
  • yes, I specify -sU.@Dogeatcatworld. – martinvigo Feb 03 '15 at 21:07
  • Thanks for pointing that out @bonsaiviking. I was able to scan all 12k ports in less than 3 secs with this command: sudo nmap -sU --min-rate 5000 -p 53000-62000 192.168.0.100 Unfortunately, I can't tell if this is any accurate. I am not getting the expected response and i can't tell if it is because that's how the protocol is or because the scan is not very accurate. – martinvigo Feb 03 '15 at 21:09