How do you detect closed UDP ports?

• A. ICMP Time Exceeded
• B. TCP RST
• C. ICMP Destination Unreachable (Port Unreachable)
• D. ICMP Echo Reply

Answer: (C)

Detecting a closed UDP port relies on the destination host signaling that no application is listening on that port. When a UDP packet arrives at a port with no listener, many systems respond with an ICMP Destination Unreachable message, specifically indicating Port Unreachable. This ICMP response is the standard indication that the UDP port is not open, since UDP itself has no handshake to reveal state. In Wireshark, you’d look for ICMP Destination Unreachable with the Port Unreachable code to confirm a closed UDP port.

Other options don’t fit this scenario: ICMP Time Exceeded is used by routing/path-related conditions (such as traceroute), not to indicate port availability; a TCP RST is a reset for a TCP connection, not UDP; and an ICMP Echo Reply is a response to a ping and doesn’t reflect UDP port status. Keep in mind that some hosts or firewalls may block ICMP or UDP responses, so lack of a reply doesn’t always prove a port is open.