Authors Top

If you have a few years of experience in the Linux ecosystem, and you’re interested in sharing that experience with the community, have a look at our Contribution Guidelines.

1. Overview

In Linux, there are useful tools using which we can test whether a UDP port is open for connection or not. In this tutorial, we’re going to see how we can use some of those tools to test UDP port connectivity.

An effective way to achieve this is port checking or port scanning. The port scanning technique determines which ports on the system are open and possibly receiving or transmitting data. We can scan the status of a port on the targeted system using one of these tools.

2. Using nmap

Network Mapper (shortened to nmap) is a network exploration tool. Depending on the options, nmap outputs a list of scanned targets with some additional information. In fact, we can use nmap to check the state of a UDP port by running nmap via the target’s IP address:

$ nmap -sU -v 172.16.38.137

Starting Nmap 6.47 ( http://nmap.org ) at 2022-07-22 22:21 IST
Initiating Parallel DNS resolution of 1 host. at 22:21
Completed Parallel DNS resolution of 1 host. at 22:21, 0.01s elapsed
Initiating UDP Scan at 22:21
Scanning 172.16.38.137 [1000 ports]
                         ...                         
UDP Scan Timing: About 68.43% done; ETC: 22:23 (0:00:54 remaining)
Completed UDP Scan at 22:24, 189.80s elapsed (1000 total ports)
Nmap scan report for 172.16.38.137
Host is up (0.00011s latency).
Not shown: 997 closed ports
PORT      STATE          SERVICE
123/udp   open           ntp
631/udp   open|filtered  ipp
5353/udp  open|filtered  zeroconf

Read data files from: /usr/bin/../share/nmap
Nmap done: 1 IP address (1 host up) scanned in 190.12 seconds
           Raw packets sent: 1075 (30.959KB) | Rcvd: 2145 (91.614KB) 

Here, the -sU option specifies a UDP scan. Additionally, we added the -v option for verbosity. From the scan’s output, we notice that UDP ports 123631, and 5353 are open. Furthermore, two of them are also filtered.

UDP port scan using nmap works by sending UDP packets of mostly no payload to each port on the targeted system. As an output, a table lists the port number with protocol, state of the port, and the service name.

The ports can have different states:

  • open – an application on the target machine is listening for a connection on this port
  • closed – no application is listening on this port
  • filtered – port responds as if behind a firewall or other network obstacle
  • unfiltered – port is responsive, but nmap is unable to classify it

Moreover, sometimes the output is a combination of two states like open|filtered or closed|filtered. This happens when nmap is unable to determine which of those two states the port has.

3. Using netcat

The netcat or nc command is a very useful networking utility in Linux. It allows us to read from and write to TCP or UDP connections. Some of the popular features of netcat are inbound or outbound TCP or UDP connections, port-scanning, data transfer, netcat relay, etc.

To check UDP connectivity, we can use netcat with the targeted IP and port:

$ nc -vz -u 8.8.8.8 443
Ncat: Version 7.70 ( https://nmap.org/ncat )
Ncat: Connected to 8.8.8.8:443.
Ncat: UDP packet sent successfully
Ncat: 1 bytes sent, 0 bytes received in 2.01 seconds.

Here, we see the UDP packet was sent successfully, so we expect UDP port 443 to be open on 8.8.8.8.

The default protocol is TCP, so we specify UDP via the -u option. The -z option specifies a port scan. Combined with -u-z sends empty UDP packets by default. If we want to send UDP payloads from a file, we can do that by appending -N with a filename as its argument. Finally, -v is used for more verbose output.

4. Using iperf

iperf is a network throughput measurement tool that can test the throughput of either UDP or TCP. We can also use this tool to validate UDP connectivity. iperf works in a client-server setup. So, we need to establish both a client and a server to use it.

Firstly, we initiate iperf on the server side using the -s (server) option:

$ iperf3 -s
-----------------------------------------------------------
Server listening on 5201
-----------------------------------------------------------

Then, we need to start this tool on the client side, targeting the server’s IP. We use -u to specify UDP, while the -c option indicates that this is the client:

$ iperf3 -u -c 172.16.38.137
Connecting to host 172.16.38.137, port 5201
[ 4] local 172.16.38.136 port 38369 connected to 172.16.38.137 port 5201
[ ID]  Interval       Transfer    Bandwidth       Total Datagrams
[ 4]   0.00-1.00 sec  120 KBytes  983 Kbits/sec   15 
[ 4]   1.00-2.00 sec  128 KBytes  1.05 Mbits/sec  16 
[ 4]   2.00-3.00 sec  128 KBytes  1.05 Mbits/sec  16 
[ 4]   3.00-4.00 sec  128 KBytes  1.05 Mbits/sec  16 
[ 4]   4.00-4.52 sec  80.0 KBytes 1.26 Mbits/sec  10 
                         ...                         

From the above output, we can see that client is connected to the server on port 5201.

5. Conclusion

In this article, we explored three command-line tools: nmapnetcat, and iperf. Using these, we can check the connectivity status of UDP ports.

Authors Bottom

If you have a few years of experience in the Linux ecosystem, and you’re interested in sharing that experience with the community, have a look at our Contribution Guidelines.

Comments are closed on this article!