nmap -sU (UDP)

sudo nmap -sU --top-ports 100 <target>

UDP port scan to discover services like DNS, SNMP, NTP, etc.

When you've already scanned TCP and want to also cover UDP services, which are often overlooked and contain attack vectors (SNMP, DNS, NTP, etc.). In practice, many admins leave UDP ports open without thinking, and that's where critical services are found.

UDP scanning is slow and noisy. Don't use it if stealth is a priority or if the firewall blocks UDP traffic. Prefer a full TCP scan before launching UDP.