UDP Port Scan

{{ SECURITY Network packet Forensic }} 

Chapter 9-2 : Port scan and Packet analysis

For TCP scan, 3-way handshaking will be used to check the opened ports.

Fro UDP scan, if some ports are opened then there will be no response. So in this case, you can checked 'ICMP unreachable' message for the closed ports.

In [Conversation] menu, select [UDP] tab.

There is no TCP like session establishment procedure. But there is ICMP protocol which is belong to layer 3.

And using filter, you can checked the open UDP ports.

   [ip.src==192.168.0.112 && ip.dst==192.168.0.15&&udp&not icmp]