1. Overview
In Linux, there are useful tools using which we can test whether a UDP port is open for connection or not. In this tutorial, we’re going to see how we can use some of those tools to test UDP port connectivity.
An effective way to achieve this is port checking or port scanning. The port scanning technique determines which ports on the system are open and possibly receiving or transmitting data. We can scan the status of a port on the targeted system using one of these tools.
2. Using nmap
Network Mapper (shortened to nmap) is a network exploration tool. Depending on the options, nmap outputs a list of scanned targets with some additional information. In fact, we can use nmap to check the state of a UDP port by running nmap via the target’s IP address:
$ nmap -sU -v 172.16.38.137
Starting Nmap 6.47 ( http://nmap.org ) at 2022-07-22 22:21 IST
Initiating Parallel DNS resolution of 1 host. at 22:21
Completed Parallel DNS resolution of 1 host. at 22:21, 0.01s elapsed
Initiating UDP Scan at 22:21
Scanning 172.16.38.137 [1000 ports]
...
UDP Scan Timing: About 68.43% done; ETC: 22:23 (0:00:54 remaining)
Completed UDP Scan at 22:24, 189.80s elapsed (1000 total ports)
Nmap scan report for 172.16.38.137
Host is up (0.00011s latency).
Not shown: 997 closed ports
PORT STATE SERVICE
123/udp open ntp
631/udp open|filtered ipp
5353/udp open|filtered zeroconf
Read data files from: /usr/bin/../share/nmap
Nmap done: 1 IP address (1 host up) scanned in 190.12 seconds
Raw packets sent: 1075 (30.959KB) | Rcvd: 2145 (91.614KB)
Here, the -sU option specifies a UDP scan. Additionally, we added the -v option for verbosity. From the scan’s output, we notice that UDP ports 123, 631, and 5353 are open. Furthermore, two of them are also filtered.
UDP port scan using nmap works by sending UDP packets of mostly no payload to each port on the targeted system. As an output, a table lists the port number with protocol, state of the port, and the service name.
The ports can have different states:
- open – an application on the target machine is listening for a connection on this port
- closed – no application is listening on this port
- filtered – port responds as if behind a firewall or other network obstacle
- unfiltered – port is responsive, but nmap is unable to classify it
Moreover, sometimes the output is a combination of two states like open|filtered or closed|filtered. This happens when nmap is unable to determine which of those two states the port has.
3. Using netcat
The netcat or nc command is a very useful networking utility in Linux. It allows us to read from and write to TCP or UDP connections. Some of the popular features of netcat are inbound or outbound TCP or UDP connections, port-scanning, data transfer, netcat relay, etc.
To check UDP connectivity, we can use netcat with the targeted IP and port:
$ nc -vz -u 8.8.8.8 443
Ncat: Version 7.70 ( https://nmap.org/ncat )
Ncat: Connected to 8.8.8.8:443.
Ncat: UDP packet sent successfully
Ncat: 1 bytes sent, 0 bytes received in 2.01 seconds.
Here, we see the UDP packet was sent successfully, so we expect UDP port 443 to be open on 8.8.8.8.
The default protocol is TCP, so we specify UDP via the -u option. The -z option specifies a port scan. Combined with -u, -z sends empty UDP packets by default. If we want to send UDP payloads from a file, we can do that by appending -N with a filename as its argument. Finally, -v is used for more verbose output.
4. Using iperf
iperf is a network throughput measurement tool that can test the throughput of either UDP or TCP. We can also use this tool to validate UDP connectivity. iperf works in a client-server setup. So, we need to establish both a client and a server to use it.
Firstly, we initiate iperf on the server side using the -s (server) option:
$ iperf3 -s
-----------------------------------------------------------
Server listening on 5201
-----------------------------------------------------------
Then, we need to start this tool on the client side, targeting the server’s IP. We use -u to specify UDP, while the -c option indicates that this is the client:
$ iperf3 -u -c 172.16.38.137
Connecting to host 172.16.38.137, port 5201
[ 4] local 172.16.38.136 port 38369 connected to 172.16.38.137 port 5201
[ ID] Interval Transfer Bandwidth Total Datagrams
[ 4] 0.00-1.00 sec 120 KBytes 983 Kbits/sec 15
[ 4] 1.00-2.00 sec 128 KBytes 1.05 Mbits/sec 16
[ 4] 2.00-3.00 sec 128 KBytes 1.05 Mbits/sec 16
[ 4] 3.00-4.00 sec 128 KBytes 1.05 Mbits/sec 16
[ 4] 4.00-4.52 sec 80.0 KBytes 1.26 Mbits/sec 10
...
From the above output, we can see that client is connected to the server on port 5201.
5. Conclusion
In this article, we explored three command-line tools: nmap, netcat, and iperf. Using these, we can check the connectivity status of UDP ports.