H3XAOperational intelligence
Live analytical pictureEvidence before assessment
TypeTechnique
External ID—
First seen2026-10-17
Last seen2026-10-17

Confidence

—

An adversary sends a UDP datagram to the remote host to determine if the host is alive. If a UDP datagram is sent to an open UDP port there is very often no response, so a typical strategy for using a UDP ping is to send the datagram to a random high port on the target. The goal is to solicit an 'ICMP port unreachable' message from the target, indicating that the host is alive. UDP pings are useful because some firewalls are not configured to block UDP datagrams sent to strange or typically unused ports, like ports in the 65K range. Additionally, while some firewalls may filter incoming ICMP, weaknesses in firewall rule-sets may allow certain types of ICMP (host unreachable, port unreachable) which are useful for UDP ping attempts.

Labels

attack-patterncapec
26 recorded

Relationships

child-ofTechnique
related-toVulnerability
related-toVulnerability
related-toVulnerability
related-toVulnerability
related-toVulnerability
related-toVulnerability
related-toVulnerability
related-toVulnerability
related-toVulnerability
related-toVulnerability
related-toVulnerability
related-toVulnerability
related-toVulnerability
related-toVulnerability
related-toVulnerability
related-toVulnerability
related-toVulnerability
related-toVulnerability
related-toVulnerability
related-toVulnerability
related-toVulnerability
related-toVulnerability
related-toVulnerability
related-toVulnerability
related-toVulnerability
1 external

References

capec
CAPEC-298
open