> nmap --privileged -Pn -sU -p- --min-rate 10000 -oN nmap/udp_ports_scan $IP This will never find most UDP services. If you don't send a service-specific probe

> nmap --privileged -Pn -sU -p- --min-rate 10000 -oN nmap/udp_ports_scan $IP This will never find most UDP services. If you don't send a service-specific probe, the service will most likely simply not answer and the situation will look like there is no service running at all. Sometimes you get an "ICMP port unreachable" in which case you know there is no service running, but more often than not you won't. You should at least use `-sV`, so nmap sends service-specific probes. This will increase scan time substantially, so if you have more than one host you might want to limit yourself to the top 100 ports with `-F`. There are surprisingly many subtleties involved with UDP scans, so I recommend reading this article: https://nmap.org/book/scan-methods-udp-scan.html https://nmap.org/book/scan-methods-udp-scan.html Also, check out nmap's timing templates (e.g. `-T4`) instead of simply setting the minimum package rate to a ludicrous value. Nmap's man page (which, in my opinion, is the best man page I ever read) says this: > Specifying a minimum rate should be done with care. Scanning faster than a network can support may lead to a loss of accuracy. In some cases, using a faster rate can make a scan take longer than it would with a slower rate. A min rate of 10000 may work in a lab environment, but I'd stick to T4 in real environments.