Hi guys,
I have a Cisco ASA being pen-tested.
A bunch of UDP ports are showing as "open." UDP scans are tricky per: https://community.qualys.com/docs/DOC-1185
"Scanning UDP ports is more inference-based, since it does not rely on acknowledgements from the remote host like TCP does, but instead collects all ICMP errors the remote host sends for each closed port. Therefore, closed ports are detected by the presence of ICMP response packets, open ports are detected by the lack of response packets."
I'm guessing the ASA drops the UDP packet and does NOT give an ICMP error response.
Can anyone confirm this?
