AT18: UDP Fragmentation
Definition
A variation of the UDP Flood. The attacker uses large packets (1500 bytes and marked as fragmented) to consume more bandwidth with fewer packets. Since these fragmented packets are forged and have no real relationship for reassembly, the victim server receiving these packets will spend CPU resources to “reassemble” useless packets. This often causes the processors to overload and sometimes reboot the entire system. This is on top of the network bandwidth bandwidth frequently consumed by these artificial packets. This attack is harder to identify because it resembles good traffic (particularly VPN traffic, which can sometimes require fragmentation).
Attack Matrix Dimensions
| Nature of IP | Handshake | Source IP Range | Packet Rate | Packet Size | Packet Content | Fragmenting | Session Rate | Session Duration | VERB Rate |
|---|---|---|---|---|---|---|---|---|---|
| Non-Spoofed | -- | Moderate | Very High | Large | Not Valid | High | -- | -- | -- |
Defense Fundamentals
Fragmented UDP floods attempt to put large packets into a link with very high packet counts. Since these are IP level Fragmented UDP packets, RFC enforcement would usually eliminate most of these attacks:
-
RFC 1858 enforcement eliminates most simple, IP level Fragmented UDP floods. This control is now under AT62.
-
Once an attack is detected, the RioRey device tracks fragments based on Source IP.
-
Since we expect similar server behaviors within a zone, a source that generate disproportional amount of fragmented UDP will be removed as attack traffic.
-
The recommended level of fragmented traffic in a zone should be no more than 20% (our recommended default). However, in networks that use 9000 byte packet sizes but make a mistake in maximum MTU negotiation, the % of legitimate fragmented traffic many be higher. This is mostly found with content download sites that are popular in Asia and Latin America. In these cases, the 20% levels may need to be increased. Within our current customer base, we have not experience any needs beyond 35%. This also includes VPN traffic, which can also experience high percentages of fragmented traffic.
Configuration Settings
Click Edit to change default setting(s). When done, remember to Save before moving on to next mitigation section.
| Feature | Default Setting | Comments |
|---|---|---|
| Filter Mode | Auto (Auto/Monitor) | Auto: Algorithms are executed and packets are filtered. Monitor: Packets are viewed, counted and all algorithms are executed. No filtering of these packets will occur Monitor mode. DDoS traffic will be identified and represented in all attack-based charts and the Zone Traffic Chart will represent zero dropped traffic. Off: No filtering or monitoring is performed. |
| Maximum fragmented percentage | 20 (0-100) | This setting adjusts the allowed ratio of IP level fragmented packets to unfragmented ones. This check is done first against total traffic in the zone, but if there is a declared victim of another UDP attack type it will be performed against traffic to that victim as well. The normal practice is to keep this at 20%, except when there are large amount of large-file-size downloads (not streaming media) with some Asian or Latin American countries, or large amounts of VPN traffic. |
Subtypes
Attack packets are classified under subtypes for better reporting. The subtype and reason the packet is labeled as invalid under its attack type can be found in the following table.
| Attack Type | Subtype | Details |
|---|---|---|
| AT18 | 17 | Excessive Fragmented Packets |