AT20: VoIP Flood
Definition
A variation of an application specific UDP Flood. A victim VoIP server receives spoofed VoIP packets at a very high packet rate and with a very large source IP range. The victim server has to sort out the proper VoIP connections from the forged ones, consuming a detrimental amount of resources. VoIP floods can overwhelm a network with packets containing randomized or fixed Source IP addresses. A fixed Source IP VoIP attack mimics traffic from large VoIP servers, and can be very difficult to identify because it resembles good traffic.
Attack Matrix Dimensions
| Nature of IP | Handshake | Source IP Range | Packet Rate | Packet Size | Packet Content | Fragmenting | Session Rate | Session Duration | VERB Rate |
|---|---|---|---|---|---|---|---|---|---|
| Spoofed | -- | Very Large | Very High | Small | Valid | -- | -- | -- | -- |
Configuration Settings
Click Edit to change default setting(s). When done, remember to Save before moving on to next mitigation section.
| Feature | Default Setting | Comments |
|---|---|---|
| Filter Mode | Auto (Auto/Monitor) | Auto: Algorithms are executed and packets are filtered. Monitor: Packets are viewed, counted and all algorithms are executed. No filtering of these packets will occur Monitor mode. DDoS traffic will be identified and represented in all attack-based charts and the Zone Traffic Chart will represent zero dropped traffic. Off: No filtering or monitoring is performed. |
| Start Port | 1000 (1-65535) | From this port up will be considered by our algorithms as possible ports for VoIP traffic. |
| Packet size max (Byte) | 332 (64-9000) | This is the maximum packet size(measured in bytes) that an incoming packet can be and still be considered a VoIP packet. |
Subtypes
Attack packets are classified under subtypes for better reporting. The subtype and reason the packet is labeled as invalid under its attack type can be found in the following table.
| Attack Type | Subtype | Details |
|---|---|---|
| AT20 | 2 | Payload data suspect (sequence within payload) |
| AT20 | 3 | Payload data suspect (repeating bytes in payload) |
| AT20 | 4 | Payload data suspect (random data in payload) |
| AT20 | 5 | Stream data suspect (random data in stream to victim, low entropy) |
| AT20 | 6 | Stream data suspect (random data in packet to victim, low entropy) |
| AT20 | 7 | Stream data suspect (random data in stream to victim, high entropy) |
| AT20 | 8 | Stream data suspect (random data in packet to victim, high entropy) |
| AT20 | 9 | Duplicate payload flood |
| AT20 | 10 | Duplicate stream payload flood |