What is a key indicator of UDP scanning?

• A. A single UDP packet to one port
• B. Multiple UDP packets followed by ICMP responses
• C. TCP handshake to multiple ports
• D. ICMP echo requests to the destination

Answer: (B)

The main idea is that UDP scanning shows a pattern of probing many ports and receiving ICMP messages in response. When a scanner sends UDP datagrams to a range of ports, closed ports typically reply with ICMP “destination unreachable—port unreachable.” Seeing a sequence of multiple UDP probes followed by ICMP responses fits this behavior and strongly indicates a port scan using UDP. In contrast, a single UDP packet to one port isn’t enough to suggest scanning, a TCP handshake reflects a TCP scan, and ICMP echo requests are simply ping activity, not UDP port discovery.