Check if a remote port is UP(listening) on UDP?

Question

I've to detect if a remote host is UP, based on it's a service(IP+Port) running. I can't use a ping because we need to make it works even the ICMP port is blocked.

Sometime the service is using TCP, sometimes UDP(but when I've to check, I know if the server has to run on UDP or TCP, it's depending of it's type). I've no issue checking the TCP port(based on https://stackoverflow.com/a/7605428/397830 ). But since UDP is not a connection oriented protocol, how could I be sure that the remote host is listening on UDP on this port?

Thank you!

Answer 1

Excerpt from nmap documentation:

UDP scan works by sending a UDP packet to every targeted port. For some common ports such as 53 and 161, a protocol-specific payload is sent, but for most ports the packet is empty. The --data-length option can be used to send a fixed-length random payload to every port or (if you specify a value of 0) to disable payloads. If an ICMP port unreachable error (type 3, code 3) is returned, the port is closed. Other ICMP unreachable errors (type 3, codes 1, 2, 9, 10, or 13) mark the port as filtered. Occasionally, a service will respond with a UDP packet, proving that it is open. If no response is received after retransmissions, the port is classified as open|filtered. This means that the port could be open, or perhaps packet filters are blocking the communication. Version detection (-sV) can be used to help differentiate the truly open ports from the filtered ones.

You can read the full article here: NMAP port scanning

Answer 2

For UDP you can integrate a "hello packet" into your protocol, once that is received on the Serverside, the server sends back another "hello packet", once the client receives that packet, it knows that the server is Up and running.

Answer 3

UDP is mostly fire and forget. If you do not get a port unreachable response, then the port may be open... try this python script:

import socket

IP = "172.16.0.1"
PORT = 1900
MESSAGE = "Hello"

sock = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
sock.sendto(MESSAGE, (IP, PORT))

While executing this, run $(tcpdump icmp and host 172.17.0.1) as root If the port is closed, you should see something like this IP 172.16.0.1 > xxx.local: ICMP 172.16.0.1 udp port 1900 unreachable, length 49 The absense of this indicates the port may be open