An attacker engages in UDP scanning to gather information about UDP port status. UDP scanning methods involve sending a UDP datagram to the target port and looking for evidence that the port is closed. Open UDP ports usually do not respond to UDP datagrams as there is no stateful mechanism within the protocol that requires building or establishing a session. Responses to UDP datagrams are therefore application specific and cannot be relied upon as a method of detecting an open port. UDP scanning relies heavily upon ICMP diagnostic messages in order to determine the status of a remote port. Firewalls or ACLs which block egress ICMP error types effectively prevent UDP scans from returning any useful information. UDP scanning is further complicated by rate limiting mechanisms governing ICMP error messages. During a UDP scan, a datagram is sent to a target port. If an ICMP Type 3 Port unreachable error message is returned then the port is considered closed. Different types of ICMP messages can indicate a filtered port.1. Speed: UDP scanning is very slow due to ICMP rate limiting2. Stealth: RPC scanning is relatively stealthy provided the sending rate does not trigger IPS/IDS sensors3. Open Port: Infers an open port based on no response, or an occasional response by a well-known service4. Closed Port: Detects a closed port using return ICMP diagnostic messages from the host5. Filtered Port: Can detect some filtered ports via ICMP diagnostic messages6. Unfiltered Port: Can detect unfiltered ports based on some ICMP diagnostic messages