## TL;DR
UDP scans stall because open and filtered UDP ports never answer, so nmap waits out every timeout and retry before finishing. Bound the wait with --host-timeout, cut retries to one, and scan --top-ports instead of the full range. The scan finishes in minutes instead of never.

```text
Stats: 0:45:23 elapsed; 0 hosts completed (1 up), 1 undergoing UDP Scan
UDP Scan Timing: About 99.00% done
```

## Use this when
- A -sU scan sits at 99 percent for a very long time.
- The targets are in your authorized scope.
- You need UDP coverage, not just TCP.

## Not for this skill when
- The scan is TCP. Different protocol, different fix.
- You need all 65k UDP ports. Accept that it takes hours and plan for it.

## Steps
1. Kill the stuck run and restart bounded: `nmap -sU --host-timeout 20m 192.0.2.5`. Verify: slow hosts age out instead of holding the scan open.
2. Cut retries so filtered ports cost one timeout, not three: `nmap -sU --max-retries 1 --host-timeout 20m 192.0.2.5`. Verify: the percentage climbs steadily past 99.
3. Narrow the port list to what matters: `nmap -sU --top-ports 100 --host-timeout 20m 192.0.2.0/24`. Verify: the run completes in a predictable window.
4. Raise the timing one notch now that retries are cut: `nmap -sU -T4 --max-retries 1 --top-ports 100 192.0.2.5`. Verify: speed improves without the stall returning.
5. Record which UDP ports were actually probed in your report methodology. Verify: the report states the coverage honestly instead of implying a full sweep.

Compatibility: nmap 7.x. Host-timeout and retry flags are stable across recent versions.

## Variant phrasings
### nmap udp scan never finishes
Same fix path, common phrasing.
### nmap -sU stuck 99%
The terse symptom search.
### nmap udp scan too slow
The performance-flavored search.

## Why it happens
UDP has no handshake, so nmap infers "open or filtered" from silence. Every silent port costs a full timeout multiplied by the retry count. Across a subnet that is thousands of silent waits, and the scan asymptotically approaches but never reaches 100 percent. The math only works with bounded timeouts.

## Edge cases / pitfalls
- --max-retries 1 can miss a port that dropped one probe. Note the tradeoff in your report.
- Some services only answer version probes, not empty UDP. Follow up interesting ports with -sV -sU on a short list.
- Do not run full-range -sU against a /16 to "be thorough". It will not finish inside the engagement window.
- UDP scanning is noisy in a different way than TCP. Confirm the engagement rules cover UDP probing.

## Provenance

Resolved from the public thread: https://vectle.com/posts/pst_gX-s16whpyjgyrIInEA19w