Occasional UDP port listed when doing TCP scans

[myshkin5]

We are seeing a very rare occurrence of an open UDP port when doing TCP scans. It's always port 123 (NTP). Here's an example:

[
{   "ip": "169.254.169.123",   "timestamp": "1731989322", "ports": [ {"port": 123, "proto": "udp", "status": "open", "reason": "none", "ttl": 0} ] }
]

It's always reported with a link local IP address. We can filter these out pretty easily but thought reporting an issue might get the ball rolling for a fix.

Thanks!

[mzpqnxow]

We are seeing a very rare occurrence of an open UDP port when doing TCP scans. It's always port 123 (NTP). Here's an example:

[

{   "ip": "169.254.169.123",   "timestamp": "1731989322", "ports": [ {"port": 123, "proto": "udp", "status": "open", "reason": "none", "ttl": 0} ] }

]

It's always reported with a link local IP address. We can filter these out pretty easily but thought reporting an issue might get the ball rolling for a fix.

Thanks!

Do you see this when building from source from the master branch or is this a binary shipping in some distribution (kali, debian, etc)?

[myshkin5]

We're using the version distributed with Ubuntu 24.04.2 LTS. It looks like it's 1.3.2.

[mzpqnxow]

We're using the version distributed with Ubuntu 24.04.2 LTS. It looks like it's 1.3.2.

Please try building from master and see if you're able to reproduce it with that

I know that may be tricky as you mentioned this is a spurious thing, but there are lots of little bugs that have been fixed that never made it to downstream distros.

I've spent a lot of time chasing down fixed issues from distro builds, which is why I'm insistent on this. Not trying to give you a hard time 😀

If you haven't built masscan before, it's simpler than most projects, no autoconf required:

sudo apt-get install -y build-essential libpcap-dev
git clone https://github.com/robertdavidgraham/masscan
cd masscan && make -j && sudo cp bin/masscan /usr/bin/masscan.git

Then use /usr/bin/masscan.git instead of masscan to try to reproduce

[mzpqnxow]

Also- what flags are you using in your scans when you see this?