> > No. I am interested too in why udp shows "open" from a foreign host, Because it received no response. > > while tcp shows filtered. Because it received no response. > > How can I check if an udp port is really closed/filtered or opened ? For UDP, remotely you can only find out if it is closed (ICMP response for close port) or filtered/open (No response at all) > I'm completely stumped on this issue. To completely graps it, you would have to make tests with tcpdump while scanning your host with different decisions: REJECT, DROP , --reject-with tcp-reset, etc... I did it once, and I know exactly what will nmap say for what it receives. Regards, Maciej
