I can't seem to find an answer for this.

Any suggestions?

  • 36
    I'd put a UDP joke in here, but I'd have no way of knowing if you got it. – Iszi Apr 11 '16 at 20:41

The difference is in the very nature of the two protocols.

TCP is a connection-oriented protocol. This means that systems must establish and confirm a stable connection - for TCP, the process is commonly known as the "three-way handshake" - before data is actually transferred. As the process must happen quickly for a good connection, it can be reasonably expected that an open TCP port will respond in short order when it is probed. This means that the timeout before assuming a port is closed may also be very short.

UDP, on the other hand, is a connectionless protocol. For UDP, communications are sent without any expectation of a timely confirmation of receipt from the remote end. Thus, one has to allow for a longer timeout before it can be assumed that a remote port is closed - even after the timeout, such assumption is not 100% assured to be valid.

In a certain way, it's kind-of like this:

  • TCP will call your phone and wait for you to actually pick up in order to warn you of a fire in your workplace. If you pick up and they talk to you, they know you've gotten the message. If your voicemail picks up, or the phone rings >4 times without a re-direct, they can be pretty sure you're not getting the message soon enough.

  • UDP will send an emergency alert announcement to your phone to tell you of the fire. They won't know if you got the message unless they see you exiting the building, 5 flights of stair-climbing and a 100-meter dash or two later. And that's assuming you were even in the building to begin with.

Now, let's say you had to notify 1,000 or so people about a fire. But you could only tell them one at a time, and had to wait for confirmation of receipt (or a reasonable time to be sure of probable non-receipt) from each one before trying the next.

Port scanning (with Nmap or any other tool) is kinda like that. TCP is gonna go relatively quick, and will probably be pretty accurate. With UDP the building will probably burn down before you get through the list just once, and you still won't be really sure whether the people you sent the message to were even around to care about it.


From the nmap page



  • 3
    please include sources – schroeder Apr 11 '16 at 20:45

They are different protocols. At UDP you have to wait for the answer for a specified timeout, at TCP you instantly see that a port is open after getting the three-way handshake. If it's closed, you are most likely to get a packet with the RST flag set, so also you can instantly move on to the next port.

It is possible to achieve some extra speed for UDP scans, with nmap you could use --min-rate, --max-rtt-timeout and --max-retries to fine tune some settings.

Your Answer

