本节书摘来自异步社区《Nmap渗透测试指南》一书中的第2章2.7节UDP Ping扫描，作者 商广明,更多章节内容可以访问云栖社区“异步社区”公众号查看。

2.7　UDP Ping扫描

表2.6所示为本章节所需Nmap命令表，表中加粗命令为本小节所需命令——UDP Ping扫描。

-PU选项是发送一个空的UDP报文到指定端口。如果不指定端口则默认是40125。该默认值可以通过在编译时改变nmap.h文件中的 DEFAULT-UDP-PROBE-PORT值进行配置。默认使用这样一个奇怪的端口是因为对于开放端口，很少会使用这种扫描方式。

使用UDP Ping扫描时Nmap会发送一个空的UDP包到目标主机，如果目标主机响应则返回一个ICMP端口不可达错误，如果目标主机不是存活状态则会返回各种ICMP错误信息。

root@Wing:~# nmap -PU -v 192.168.121.1Starting Nmap 6.47 ( http://nmap.org ) at 2015-06-28 11:58 CSTInitiating Ping Scan at 11:58Scanning 192.168.121.1 [1 port]Completed Ping Scan at 11:58, 0.00s elapsed (1 total hosts)Initiating Parallel DNS resolution of 1 host. at 11:58Completed Parallel DNS resolution of 1 host. at 11:58, 0.01s elapsedInitiating SYN Stealth Scan at 11:58Scanning 192.168.121.1 [1000 ports]Discovered open port 135/tcp on 192.168.121.1Discovered open port 139/tcp on 192.168.121.1Discovered open port 445/tcp on 192.168.121.1Discovered open port 49165/tcp on 192.168.121.1Discovered open port 912/tcp on 192.168.121.1Increasing send delay for 192.168.121.1 from 0 to 5 due to 123 out of 409 dropped probes since last increase.Discovered open port 902/tcp on 192.168.121.1Discovered open port 49152/tcp on 192.168.121.1Discovered open port 49155/tcp on 192.168.121.1Discovered open port 49153/tcp on 192.168.121.1Discovered open port 8000/tcp on 192.168.121.1Discovered open port 7000/tcp on 192.168.121.1Discovered open port 843/tcp on 192.168.121.1Completed SYN Stealth Scan at 12:00, 110.73s elapsed (1000 total ports)Nmap scan report for 192.168.121.1Host is up (1.00s latency).Not shown: 987 closed portsPORT　　　STATE　　SERVICE135/tcp　 open　　 msrpc139/tcp　 open　　 netbios-ssn445/tcp　 open　　 microsoft-ds514/tcp　 filtered shell843/tcp　 open　　 unknown902/tcp　 open　　 iss-realsecure912/tcp　 open　　 apex-mesh7000/tcp　open　　 afs3-fileserver8000/tcp　open　　 http-alt49152/tcp open　　 unknown49153/tcp open　　 unknown49155/tcp open　　 unknown49165/tcp open　　 unknownRead data files from: /usr/bin/../share/nmapNmap done: 1 IP address (1 host up) scanned in 110.79 seconds　　　　　 Raw packets sent: 1724 (75.840KB) | Rcvd: 1009 (40.661KB)root@Wing:~#

从输出的结果中可以得知目标主机是存活状态，这表明目标主机存活时会返回一个ICMP端口不可达的信息，这里我们使用Wireshark获取数据包分析。

如图2.4所示，捕获的包中有一条信息为“Destination unreachable”，这表明目标不可达，在详细信息面板中可以看到使用的端口为40125，也可以指定使用其他端口。

root@Wing:~# nmap -PU80,111 -v 192.168.121.1Starting Nmap 6.47 ( http://nmap.org ) at 2015-06-28 12:26 CSTInitiating Ping Scan at 12:26Scanning 192.168.121.1 [2 ports]Completed Ping Scan at 12:26, 0.00s elapsed (1 total hosts)Initiating Parallel DNS resolution of 1 host. at 12:26Completed Parallel DNS resolution of 1 host. at 12:26, 0.01s elapsedInitiating SYN Stealth Scan at 12:26Scanning 192.168.121.1 [1000 ports]

如图2.5所示有两个ICMP包，且包的信息都是“Destination unreachable”，详细信息面板中的端口为25。