nmap udp scan stuck at 99 percent on authorized scope, never completes

TL;DR

UDP scans stall because open and filtered UDP ports never answer, so nmap waits out every timeout and retry before finishing. Bound the wait with --host-timeout, cut retries to one, and scan --top-ports instead of the full range. The scan finishes in minutes instead of never.

Stats: 0:45:23 elapsed; 0 hosts completed (1 up), 1 undergoing UDP Scan
UDP Scan Timing: About 99.00% done

Use this when

• A -sU scan sits at 99 percent for a very long time.
• The targets are in your authorized scope.
• You need UDP coverage, not just TCP.

Not for this skill when

• The scan is TCP. Different protocol, different fix.
• You need all 65k UDP ports. Accept that it takes hours and plan for it.

Steps

1. Kill the stuck run and restart bounded: nmap -sU --host-timeout 20m 192.0.2.5. Verify: slow hosts age out instead of holding the scan open.
2. Cut retries so filtered ports cost one timeout, not three: nmap -sU --max-retries 1 --host-timeout 20m 192.0.2.5. Verify: the percentage climbs steadily past 99.
3. Narrow the port list to what matters: nmap -sU --top-ports 100 --host-timeout 20m 192.0.2.0/24. Verify: the run completes in a predictable window.
4. Raise the timing one notch now that retries are cut: nmap -sU -T4 --max-retries 1 --top-ports 100 192.0.2.5. Verify: speed improves without the stall returning.
5. Record which UDP ports were actually probed in your report methodology. Verify: the report states the coverage honestly instead of implying a full sweep.

Compatibility: nmap 7.x. Host-timeout and retry flags are stable across recent versions.

Variant phrasings

nmap udp scan never finishes

Same fix path, common phrasing.

nmap -sU stuck 99%

The terse symptom search.

nmap udp scan too slow

The performance-flavored search.

Why it happens

UDP has no handshake, so nmap infers "open or filtered" from silence. Every silent port costs a full timeout multiplied by the retry count. Across a subnet that is thousands of silent waits, and the scan asymptotically approaches but never reaches 100 percent. The math only works with bounded timeouts.

Edge cases / pitfalls

• --max-retries 1 can miss a port that dropped one probe. Note the tradeoff in your report.
• Some services only answer version probes, not empty UDP. Follow up interesting ports with -sV -sU on a short list.
• Do not run full-range -sU against a /16 to "be thorough". It will not finish inside the engagement window.
• UDP scanning is noisy in a different way than TCP. Confirm the engagement rules cover UDP probing.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_gX-s16whpyjgyrIInEA19w