Introduction
Welcome to the TCP and UDP Port Scanning lab. Port scanning is a fundamental technique used by network administrators and security professionals to discover active services on a computer network. By sending specific network packets to a target and analyzing the responses, we can determine which ports are open, closed, or filtered by a firewall.
An open port does not automatically mean "vulnerable," but it does mean "reachable service boundary." That is why port scanning is central to reconnaissance. It identifies the doors a system is exposing to the network.
In this lab, you will explore the low-level mechanics of network port scanning using Nmap (Network Mapper), the industry-standard tool for network discovery. You will learn how to perform three distinct types of scans: the reliable TCP Connect scan, the stealthy TCP SYN scan, and the connectionless UDP port scan. Through hands-on practice, you will understand how different network protocols respond to scanning probes.
Execute TCP Connect Scan (-sT)
In this step, we will begin by performing a TCP Connect scan. You are currently in your default working directory, ~/project.
A TCP Connect scan is the most straightforward type of port scan. It relies on the operating system's built-in network functions to establish a full connection with the target port. This means it completes the entire TCP three-way handshake: it sends a SYN packet, receives a SYN-ACK packet from the target, and finally sends an ACK packet back to establish the connection.
Because it uses the normal networking stack, this scan is conceptually simple and reliable. It is also a good reminder that scanning is really just controlled interaction with how protocols are designed to behave.
Because it completes the connection, this scan is highly reliable. However, it is also very "noisy." Since a full connection is made, the target system's application logs will almost certainly record the connection attempt, making it easy for administrators to detect the scan.
Let's use Nmap to perform a TCP Connect scan against our local machine (localhost) on port 8080, where a background web service is currently running. The -sT flag tells Nmap to use the TCP Connect method, and the -p flag specifies the port number.
Execute the following command in your terminal:
nmap -sT -p 8080 localhost
After running the command, you should see an output similar to this:
Starting Nmap 7.80 ( https://nmap.org ) at 2026-03-07 15:56 CST
Nmap scan report for localhost (127.0.0.1)
Host is up (0.000086s latency).
Other addresses for localhost (not scanned): ::1
PORT STATE SERVICE
8080/tcp open http-proxy
Nmap done: 1 IP address (1 host up) scanned in 0.02 seconds
The output clearly shows that port 8080 is open and is using the TCP protocol. The service is identified as http-proxy (or similar, depending on the Nmap version), which matches the Python HTTP server we have running in the background.
Execute Stealth SYN Scan (-sS)
In this step, we will explore a more advanced and commonly used technique: the TCP SYN scan, also known as a "Half-Open" scan.
Unlike the TCP Connect scan, the SYN scan does not complete the three-way handshake. It sends a SYN packet (requesting a connection) and waits for a response. If the target port is open, it responds with a SYN-ACK packet. At this point, instead of sending an ACK to complete the connection, Nmap immediately sends an RST (Reset) packet to tear down the connection before it is fully established.
This is why SYN scanning is often described as "half-open." It still relies on the target's TCP behavior, but it minimizes how much of the connection gets completed.
This method is considered "stealthy" because many applications only log fully established connections. By tearing down the connection early, the SYN scan often bypasses application-level logging. However, because it requires crafting raw network packets rather than using standard operating system functions, this scan requires root (sudo) privileges.
Let's perform a SYN scan against the same port 8080 on our local machine. We will use the -sS flag to specify the SYN scan method.
Execute the following command in your terminal:
sudo nmap -sS -p 8080 localhost
You will see an output similar to the previous step:
Starting Nmap 7.80 ( https://nmap.org ) at 2026-03-07 15:56 CST
Nmap scan report for localhost (127.0.0.1)
Host is up (0.000042s latency).
Other addresses for localhost (not scanned): ::1
PORT STATE SERVICE
8080/tcp open http-proxy
Nmap done: 1 IP address (1 host up) scanned in 0.09 seconds
Notice that the result is identical—the port is still identified as open. The difference lies entirely in how the network packets were exchanged behind the scenes. The SYN scan is the default scan type in Nmap when you run it with sudo privileges because of its speed and stealth.
Execute UDP Port Scan (-sU)
In this final step, we will shift our focus from TCP to UDP (User Datagram Protocol).
UDP is a connectionless protocol. Unlike TCP, there is no handshake process to establish a connection before sending data. When you send a UDP packet to a port, the target does not typically send an acknowledgment back if the port is open. It only responds with an "ICMP Port Unreachable" error if the port is closed.
That asymmetry is why UDP scans are harder to interpret. Silence may mean success, filtering, or nothing at all. Analysts therefore need to read UDP results more carefully than TCP results.
This makes UDP scanning notoriously difficult and slow. If Nmap sends a UDP packet and receives no response, it cannot be entirely sure if the port is open and silently accepting data, or if a firewall simply dropped the packet. Therefore, Nmap often reports these ports as open|filtered.
Let's perform a UDP scan against an arbitrary port (like 5353) that we know is not currently hosting a service on our local machine. This will demonstrate how the operating system responds when a port is explicitly closed. Like the SYN scan, UDP scanning requires root privileges to craft raw packets.
Execute the following command in your terminal:
sudo nmap -sU -p 5353 localhost
The scan might take slightly longer than the TCP scans. Once it completes, you should see an output similar to this:
Starting Nmap 7.80 ( https://nmap.org ) at 2026-03-07 15:56 CST
Nmap scan report for localhost (127.0.0.1)
Host is up (0.000038s latency).
Other addresses for localhost (not scanned): ::1
PORT STATE SERVICE
5353/udp closed zeroconf
Nmap done: 1 IP address (1 host up) scanned in 1.09 seconds
Notice the state is reported as closed. When Nmap sends a UDP packet to a closed port, the target's operating system typically responds with an "ICMP Port Unreachable" error message. Because Nmap received this explicit error, it can confidently mark the port as closed. If a service was running on this port and simply didn't respond (which is common for UDP apps), Nmap would not receive this ICMP error and would likely report the port state ambiguously as open|filtered. This reliance on ICMP error messages is a hallmark of UDP port scanning.
Summary
Congratulations! You have successfully completed the TCP and UDP Port Scanning lab.
In this lab, you learned how to use Nmap to perform different types of network scans. You started with the reliable but noisy TCP Connect scan (-sT), which completes the full three-way handshake. You then moved on to the stealthy TCP SYN scan (-sS), which identifies open ports by leaving connections half-open to evade basic logging. Finally, you explored the complexities of the connectionless UDP scan (-sU), understanding why UDP ports often appear as open|filtered.
These fundamental scanning techniques are essential skills for understanding network topology and securing systems against unauthorized access.
