AT22: Non-Spoofed UDP Flood
Definition
During this attack, a victim server receives non-spoofed UDP packets at a very high packet rate and is overwhelmed by the large amount of incoming UDP packets. The attack consumes network resources and available bandwidth, exhausting the network until it shuts down. In Non-Spoofed UDP Flood packets, the source IP is the actual public IP of the attacker bot (or frequently, a public service being abused for reflection purposes), and the source IP range is equal to the number of bots or reflection targets used in the attack. This type of attack is harder to identify because it resembles good traffic.
Attack Matrix Dimensions
| Nature of IP | Handshake | Source IP Range | Packet Rate | Packet Size | Packet Content | Fragmenting | Session Rate | Session Duration | VERB Rate |
|---|---|---|---|---|---|---|---|---|---|
| Non-Spoofed | -- | Small | Very High | Vector Dependent | Valid | -- | -- | -- | -- |
Defense Fundamentals
In situations where an attacker has compromised a large server at a hosting center, they can launch a very large non-spoofed UDP flood attack with various kinds of payloads.
RioRey's UDP algorithm watches for a large amount of UDP packets generated by a single source IP. The adjustment in UDP flood mitigation sets the number of ppm (packets per minute) that will be examined by a single source/destination IP UDP stream.
Payload entropy algorithms are applied, and in cases of no entropy or excessive entropy, the source/destination IP UDP traffic will be rate limited to same rate specific.
Certain well known protocols known to be abused for reflection (such as SSDP, NTP and QOTD) also have special controls here.
Configuration Settings
Click Edit to change default setting(s). When done, remember to Save before moving on to next mitigation section.
| Feature | Default Setting | Comments |
|---|---|---|
| Filter Mode | Auto (Auto/Monitor) | Auto: Algorithms are executed and packets are filtered. Monitor: Packets are viewed, counted and all algorithms are executed. No filtering of these packets will occur Monitor mode. DDoS traffic will be identified and represented in all attack-based charts and the Zone Traffic Chart will represent zero dropped traffic. Off: No filtering or monitoring is performed. |
| Disable payload scoring (RIOS 5.3.0 or greater) | Unchecked | If checked, all data payload tests are disabled. QOTD, SSDP, chargen, and NTP tests are still performed based on their settings. |
| Good payload score low threshold (RIOS 5.6.0 or greater) | 15 | |
| Good payload score high threshold (RIOS 5.6.0 or greater) | 95 | |
| Enable duplicate payload test (RIOS 5.6.0 orz greater) | Checked | |
| Allow QOTD traffic (RIOS 5.2.9 or greater) | Disabled | If enabled, allows Quote of the Day (QOTD) traffic over UDP Port 17. |
| Allow SSDP traffic (RIOS 5.3.0 or greater) | Enabled | If enabled, allows Simple Service Discovery Protocol (SSDP) traffic over UDP Port 1900. |
| Allow chargen traffic (RIOS 5.2.9 or greater) | Disabled | If enabled, allows Character Generation Protocol (CHARGEN) traffic over UDP Port 19. |
| Validate NTP packets (RIOS 5.2.9 or greater) | Enabled | If enabled, validates the NTP packet header and restricts NTP packets to the NTP versions allowed (Default versions are 2, 3 and 4) and NTP private mode request codes allowed (if it is an NTP private mode packet). |
| Block UDP port pairs (RIOS 7.0.0 or greater) | None | Hitting Add creates a new row of two text boxes, symbolizing the Source Port to Destination port UDP traffic to drop. Using the "*" character symbolizes a wild card. Wild cards can be used in either the Source or Destination for a given entry, but not both (dropping all UDP traffic can be enabled in AT 62). Any UDP traffic matching the block port pair specified will be dropped as subtype 16 (shown below). Entries can be removed by hitting Delete. A maximum of 10 "Block" and "Allow" entries can be set up in a single Zone. |
| Only allow specified UDP port pairs (RIOS 7.0.0 or greater) | Disabled | Enabling this control enables entry of "Allow" Source to Destination port pairs. Unlike the "Block" specifications, only the traffic matching an "Allow" entry will be permitted in the zone. Traffic dropped due to not matching an "Allow" entry will be recorded as subtype 17 (shown below). |
| Allow UDP port pairs (RIOS 7.0.0 or greater) | None | Hitting Add creates a new row of two text boxes, symbolizing the Source Port to Destination port UDP traffic that should be allowed in the zone. Using the "*" character symbolizes a wild card. Wild cards can be used in either the Source or Destination for a given entry, but not both. Any UDP traffic NOT matching an allow port pair specified will be dropped as subtype 17 (shown below). Entries can be removed by hitting Delete. A maximum of 10 "Block" and "Allow" entries can be set up in a single Zone. |
| Show NTP advanced controls (RIOS 5.2.9 or greater) | Disabled | Enabling this control creates a drop down menu showing you more options for NTP filtering that are used by Validate NTP Packets: NTP versions allowed: Highlighted numbers are the versions of NTP traffic that are allowed. NTP private mode request codes allowed: Highlighted numbers are the request codes that are permitted when it is an NTP private mode packet. |
Subtypes
Attack packets are classified under subtypes for better reporting. The subtype and reason the packet is labeled as invalid under its attack type can be found in the following table.
| Attack Type | Subtype | Details |
|---|---|---|
| AT22 | 1 | No payload data flood |
| AT22 | 2 | Payload data suspect (sequence) |
| AT22 | 3 | Payload data suspect (repeating) |
| AT22 | 4 | Payload data suspect (random) |
| AT22 | 5 | Stream data suspect (random, low) |
| AT22 | 6 | Payload data suspect (random, low) |
| AT22 | 7 | Stream data suspect (random, high) |
| AT22 | 8 | Payload data suspect (random, high) |
| AT22 | 9 | Duplicate payload flood |
| AT22 | 10 | Duplicate stream payload flood |
| AT22 | 11 | Attack stream packet |
| AT22 | 16 | Source or destination port closed |
| AT22 | 17 | Source or destination port not allowed |
| AT22 | 21 | Invalid NTP Packet |
| AT22 | 22 | NTP version or private mode request/response code not allowed |