I am doing some research and I need a very quick way to scan for open ports on a single machine. To provide some context, I know that my machine will have a port open waiting for UDP packets for about 3 seconds. That is all I have. I also know that it is in the range of port 50000 to 62000.

Long story short, how can I scan 12000 ports in less than 3 seconds?

I tried to find the answer myself first. I put my hopes in zmap but it seems to work on different IPs, not different ports for a single IP.

I played with nmap with -T5 and --min-parallelism/max-parallelism but it takes minutes to scan those 12k ports.

  • Do you know which service is provided on this UDP port, or at least do you know some string which will make the service to reply? Commented Feb 3, 2015 at 11:23
  • 1
    Have you tried Unicornscan? It tends to be much faster than nmap for UDP scans.
    – schroeder
    Commented Feb 3, 2015 at 19:33
  • @GZBK unfortunatelly not. I know is some kind of VOIP service but I suspect it is a privative protocol, not RTP.
    – martinvigo
    Commented Feb 3, 2015 at 21:03
  • @schroeder I was not aware of that one, will definitely try out. Thanks!
    – martinvigo
    Commented Feb 3, 2015 at 21:04
  • Use fast ports (e.g., 10GbE, GbE) and either a fast switch backplane (e.g., Cisco Catalyst 6500) or a cross-over cable with unicornscan -L 45 -r 10000 -Iv -mU
    – atdre
    Commented Apr 14, 2015 at 21:23

1 Answer 1


Are you explicitly specifying a UDP scan in nmap (-sU)?

I would be surprised if you can get the time down to 3 seconds. Also be aware that using -T5 can cause issues, such as DoS or inaccurate results.

Also be aware that there is no requirement for UDP ports to reply to your packets, which is why UDP scanning is more difficult than TCP.

Ref: https://nmap.org/book/man-port-scanning-techniques.html

Edited to add: Doing a bit more searching I found this question which has some methods to speed up UDP scans, and their drawbacks.

  • If the host is nice, it will send you an ICMP port unreachable if the UDP port is not listening. Commented Feb 3, 2015 at 14:38
  • 2
    @Dogeatcatworld But it will likely rate-limit those responses to 1 per second, so Nmap will slow down accordingly in order to catch them all. This is the major source of UDP slowness in Nmap vs asynchronous scanner that doesn't care about closed ports. Commented Feb 3, 2015 at 14:41
  • Thanks, I did not know about this. Do you know if this rate limit is set globally, or pr client address? Commented Feb 3, 2015 at 14:49
  • yes, I specify -sU.@Dogeatcatworld.
    – martinvigo
    Commented Feb 3, 2015 at 21:07
  • Thanks for pointing that out @bonsaiviking. I was able to scan all 12k ports in less than 3 secs with this command: sudo nmap -sU --min-rate 5000 -p 53000-62000 Unfortunately, I can't tell if this is any accurate. I am not getting the expected response and i can't tell if it is because that's how the protocol is or because the scan is not very accurate.
    – martinvigo
    Commented Feb 3, 2015 at 21:09

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .