An attacker scan for RPC services listing on a Unix/Linux host. This type of scan can be obtained via native operating system utilities or via port scanners like nmap. When performed by a scanner, an RPC datagram is sent to a list of UDP ports and the response is recorded. Particular types of responses can be indicative of well known RPC services running on a UDP port.1. Speed: Direct RPC scans that bypass portmapper/sunrpc are typically slow compare to other scan types2. Stealth: RPC scanning is not stealthy, as IPS/IDS systems detect RPC queries3. Open Port: Can only detect open ports when an RPC service responds4. Closed Port: Detects closed ports on the basis of ICMP diagnostic messages.5. Filtered Port: Cannot identify filtered ports6. Unfiltered Port: Cannot identify unfiltered ports