Due to the recent increase of reflection attacks noted by Akamais security teams using original RIP(classful, depreciated) I'm interested to see if some of the CPE running within a network segment here is still open to such abuse. Theres a rather large fleet of a certain model that I strongly suspect is.
My problem is that NMAP cant determine if ports are closed or filtered with UDP.
nmap -p 520 -v -sU -Pn ??.??.0.0/13
This will produce
520/udp open|filtered route
On every address.
Is there an adjustment I can make to properly probe in this manner?