An adversary engages in UDP scanning to gather information about UDP port status on the target system. UDP scanning methods involve sending a UDP datagram to the target port and looking for evidence that the port is closed. Open UDP ports usually do not respond to UDP datagrams as there is no stateful mechanism within the protocol that requires building or establishing a session. Responses to UDP datagrams are therefore application specific and cannot be relied upon as a method of detecting an open port. UDP scanning relies heavily upon ICMP diagnostic messages in order to determine the status of a remote port.

How does a UDP Scan attack work?

It typically unfolds over 2 phases. It begins with: An adversary sends UDP packets to target ports.

How do you prevent CAPEC-308?

Firewalls or ACLs which block egress ICMP error types effectively prevent UDP scans from returning any useful information.

What weaknesses does CAPEC-308 target?

CAPEC-308 exploits 1 CWE weakness, including CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor).

How severe is CAPEC-308?

MITRE rates CAPEC-308 as Low severity.

CAPEC-308: UDP Scan

During a UDP scan, a datagram is sent to a target port. If an 'ICMP Type 3 Port unreachable' error message is returned then the port is considered closed. Different types of ICMP messages can indicate a filtered port. UDP scanning is slower than TCP scanning. The protocol characteristics of UDP make port scanning inherently more difficult than with TCP, as well as dependent upon ICMP for accurate scanning. Due to ambiguities that can arise between open ports and filtered ports, UDP scanning results often require a high degree of interpretation and further testing to refine. In general, UDP scanning results are less reliable or accurate than TCP-based scanning.

CAPEC-308: UDP Scan

CAPEC-308: UDP Scan

Overview

How the attack works

What the attacker needs

Prerequisites

Resources required

Consequences

How to mitigate it

Frequently asked questions

What is CAPEC-308?

How does a UDP Scan attack work?

How do you prevent CAPEC-308?

What weaknesses does CAPEC-308 target?

How severe is CAPEC-308?

References

Defend against CAPEC-308

Overview

How the attack works

What the attacker needs

Prerequisites

Resources required

Consequences

How to mitigate it

Related weaknesses

Related attack patterns

Parent

Frequently asked questions

What is CAPEC-308?

How does a UDP Scan attack work?

How do you prevent CAPEC-308?

What weaknesses does CAPEC-308 target?

How severe is CAPEC-308?

References

Defend against CAPEC-308