It includes a variety of scan types designed for different use cases. Nmap is probably the most widely-used tool for network scanning and reconnaissance. Two common malicious uses of UDP are for scanning and in DDoS amplification attacks. However, some attacks are enabled specifically by the features of the UDP protocol. UDP is primarily intended for carrying other types of traffic. The UDP packet header also includes a length value and a checksum for verifying the accuracy of the data that it contains. As shown, UDP uses the same port model as TCP, and applications that use both TCP and UDP will often use the same ports in each. The screenshot above shows the details of a standard UDP packet header. As a result, DNS often does not require the reliability guarantees that TCP provides, and the overhead of the TCP handshake is superfluous. DNS requests and responses are relatively small, and, if something goes wrong and a packet is dropped, it is easy to make another request. UDP in WiresharkĪn extremely common use of the UDP protocol is for DNS traffic. As a result, UDP is commonly used in applications where all the data can be contained within a single packet and either packet loss is not a major problem (like in DNS) or high-speed transmissions are necessary (like gaming). After a UDP packet is sent, there is no acknowledgement of receipt from the destination and lost packets are not transmitted. It is a “fire and forget” protocol, which does not retain state. UDP, on the other hand, is intended for applications that prioritize latency over reliability.

Wireshark filter udp port