I am new to nmap and I use zenmap "intense scan plus udp" to scan my router lan port , there has difference unknown "UDP" port each scan ,but each time I use lsof or netstat doesn't shown those udp port. How is possible happened?

The following is my command "nmap -sS -sU -T4 -A -v"

  • Tell us what port. – user13695 Sep 6 '16 at 7:24
  • like 21524 ,41702,42639,51554,60331 those highest udp port. But each time those udp port scan different . – GreenHand Sep 6 '16 at 8:11

...like 21524 ,41702,42639,51554,60331 those highest udp port

There is probably a socket waiting for data on this port for a short time only. Typical examples are DNS lookups where each request should use a different origin port to deter DNS spoofing attacks. And this socket (and thus the port) is immediately closed after the DNS response is received. Thus you will not find it with netstat or similar if you look a few seconds later.

  • Hi Steffen, I known it . But even each I remove all daemon service and remove the module, it still has open udp port scanned by nmap – GreenHand Sep 8 '16 at 3:30
  • @GreenHand: DNS lookups are not only done by daemons but can be done by any processes. And there are probably processes running on the machine. Apart from that I have no idea what you mean with "remove the 'module". – Steffen Ullrich Sep 8 '16 at 4:09

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.