UDP Port Scan

$source sent an unusually high number of UDP packets to different ports or hosts. This behavior indicates a potential reconnaissance scan. An attacker might be looking for devices or services that are listening on open UDP ports.

An attacker initiates a UDP port scan to search for services that are listening on open UDP ports. Port scans are a common form of reconnaissance. First, an attacker sends a UDP datagram to many ports on a network. The attacker can then ignore closed ports that returned an ICMP unreachable error. UDP scans are considered to be less informative than TCP scans, but they can reveal common services that communicate over UDP, such as DNS, SNMP, or DHCP. Tools for performing such scans are widely available, including the popular Nmap Security Scanner.