A UDP scan works by implying state:

• If a UDP port is probed and a PORT UNREACHABLE packet comes back, the port is marked as closed.
• If a UDP port is probed and nothing comes back, it is marked as open.

If you block only certain UDP ports, then strangely, you appear to have those ports open to a scanner. It is better to simply block response from ANY and ALL UDP ports. That way, you are not giving away any information at all.

got feedback? got feedback?

Any feedback you provide is sent to the owner of this FAQ for possible incorporation and shown publically as well.

by KeysCapt
last modified: 2004-02-01 05:38:05