

DNS, SNMP, and DHCP (registered ports 53, 161/162, and 67/68) are three of the most common. While most popular services on the Internet run over the TCP protocol, UDP services are widely deployed. Instead of writing raw packets as most other scan types do, Nmap asks the underlying operating system to establish a connection with the target machine and port by issuing the connect system call. This is the case when a user does not have raw packet privileges. TCP connect scan is the default TCP scan type when SYN scan is not an option. It is also relatively unobtrusive and stealthy, since it never completes TCP connections. It can be performed quickly, scanning thousands of ports per second on a fast network not hampered by restrictive firewalls. SYN scan is the default and most popular scan option, for good reasons.
