The argument 30 likely refers to a target, a port number, or a timing variable. In a network context, targeting port 30 specifically is significant. Although port 30 is not one of the "famous" ports (like port 80 for HTTP or 53 for DNS), it represents the vast array of potential service ports that administrators must audit. Malicious actors often utilize higher or obscure numbered ports to hide backdoors or unauthorized services, knowing that standard scans often focus on well-known ports. Alternatively, if 30 represents a timeout value, it suggests a deliberate attempt to counter the latency issues inherent in UDP scanning, allowing the tool ample time to wait for slow or delayed ICMP responses.
: By scanning for port 3389 (RDP), they identify systems they can take over using stolen credentials. kportscan 30 upd
A hypothetical (or proprietary) kernel-level UDP port scanner that runs for 30 seconds, scanning ports (likely 1–1024) or sending 30 probe packets, reporting open/filtered UDP ports by intercepting ICMP errors in kernel space. The argument 30 likely refers to a target,