While TCP is by far the more common protocol, UDP services such as DNS and SNMP are widely deployed. The syntax to trigger a UDP Scan is:

nmap -sU <IP address>

Due to UDP being a connectionless protocol, UDP scanning can take much longer to complete. UDP scans will send protocol specific packets to common protocols such as DNS and SNMP, and a generic UDP packet to all other target ports. Nmap then compares the response to identify whether a port is open or not.

A UDP port that receives a packet and replies with an ICMP Port Unreachable error (ICMP Type 3, code 3), is deemed to be closed.

A UDP port that receives a packet and does not reply with any data is deemed to be open/filtered. The use of open/filtered is based on the assertion that either the port is truly open, or that it is closed but there is some sort of packet filtering taking place that is blocking the ICMP port unreachable error from getting back.

‍