AT17: UDP Flood
Definition
During a UDP flood, a victim server receives spoofed UDP packets at a very high packet rate and with a large source IP range. The victim server is overwhelmed by the large number of incoming UDP packets. The attack consumes network resources and available bandwidth, exhausting the network until it shuts down. A full communication handshake is not used in the UDP protocol to exchange data, making UDP attacks difficult to detect and extremely effective in flooding network bandwidth. UDP floods can overwhelm a network with packets containing randomized or fixed Source IP addresses and can be designed to target a specific server by using the victim’s information as the Destination port and IP within the packets.
Attack Matrix Dimensions
| Nature of IP | Handshake | Source IP Range | Packet Rate | Packet Size | Packet Content | Fragmenting | Session Rate | Session Duration | VERB Rate |
|---|---|---|---|---|---|---|---|---|---|
| Spoofed | -- | Very Large | Very High | Variable | Not Valid | High | -- | -- | -- |
Defense Fundamentals
The method to generating a Spoofed IP UDP flood is very similar to a Spoofed IP SYN Flood. However, since UDP is stateless, the method to identify the precise attacker and mitigate the attack is very different than TCP floods:
-
Detection can be done by the source IP distribution.
-
This IP source distribution randomness is adjusted by the Filter Sensitivity Level.
-
Source IP distribution is effective but lacks the 99+% accuracy of similar TCP filters. This filter can usually achieve 85-95% effectiveness, but there is an added payload randomness tester as well.
-
In a UDP Flood, the payload tends to have very low entropy (same payload from the same bot) or is totally random. These two extremes are taken into account in the Filter Sensitivity Level.
-
Most website providers do not use UDP port 80. However a few larger services do (largely for QUIC traffic), and in any event port 80 is defined officially for both TCP and UDP. Therefore, there is a separate option to filter Port 80 UDP under AT62.
Configuration Settings
Click Edit to change default setting(s). When done, remember to Save before moving on to next mitigation section.
| Feature | Default Setting | Comments |
|---|---|---|
| Filter Mode | Auto (Auto/Monitor) | Auto: Algorithms are executed and packets are filtered. Monitor: Packets are viewed, counted and all algorithms are executed. No filtering of these packets will occur Monitor mode. DDoS traffic will be identified and represented in all attack-based charts and the Zone Traffic Chart will represent zero dropped traffic. Off: No filtering or monitoring is performed. |
| Filter sensitivity | Level 5 (1-10) | This feature allows the user to adjust the sensitivity level of the filter for UDP Flood DDoS attacks. The recommended default setting is level 5. To reduce filter sensitivity, lower the setting number. The higher the setting, the more sensitive the filter becomes. Due to the aggressiveness of the setting, Level 10 is liable to drop some good traffic. Alter the sensitivity settings gradually as needed. |
| Show advanced controls | Disabled | Enabling this control opens up all of the advanced controls for AT17 (listed below). By default, the controls will populate at their settings for the currently set filter sensitivity level. The advanced controls require careful configuration in order to work correctly. They should only be adjusted after direct consultation with RioRey. |
| Gate 1 Packet Threshold | ||
| Gate 2 Packet Threshold | ||
| Attack Packet Threshold | ||
| Attack Packet Percentage Threshold | ||
| Detection Sample Periods Min. | ||
| Non-spoofed Attack Detection Threshold | ||
| Random IP Attack Bucket Count Min. | ||
| Random IP Dynamic Bucket | ||
| Random IP Dynamic Bucket Parameter | ||
| Random IP Attack Value Max. | ||
| Packets Tested Per Sample Period | ||
| Identical Packet Test Threshold | ||
| Identical Packet Attack Filter Threshold |