Which Metasploit module performs UDP sweeps by sending UDP packets to common ports to elicit a response?

• A. auxiliary/scanner/portscan/syn
• B. auxiliary/scanner/portscan/tcp
• C. auxiliary/discovery/udp_sweep
• D. auxiliary/security/udp_test

Answer: (C)

UDP sweeps discover live UDP services by sending UDP probes to a set of common ports and then watching for any responses or the absence of responses to infer which ports might be reachable. Because UDP lacks a handshake, a port may appear reachable only if the host responds, often with an ICMP message when the port is closed or with some form of application data if a service responds. This makes automated discovery tricky but still useful for mapping UDP services.

The module that performs this exact task in Metasploit is the UDP sweep discovery module. It targets UDP ports, sends probes, and reports back where responses or indicative errors are observed, helping you identify which UDP services exist on the target and which ports may be filtered or closed.

The other options are not matching because one is a TCP-focused SYN scan, which probes TCP ports rather than UDP, and another is a TCP port scan module. The remaining option is not a UDP sweep discovery tool, so it wouldn’t provide the broad UDP port discovery or service fingerprints you get from a dedicated UDP sweep module.