A UDP flood attack is a denial of service attack where an attacker overwhelms a targeted host with UDP packets. UDP is a connectionless protocol that does not require handshaking, allowing it to be used to launch attacks. While firewalls can filter unwanted traffic, they too can be overwhelmed. There are several ways to mitigate UDP flood attacks, such as rate limiting ICMP responses, firewall filtering, and filtering UDP packets except for DNS at the network level. Advanced mitigation techniques involve load balancing attacks across scrubbing servers using anycast technology and deep packet inspection to filter out malicious packets.

1. Prepared By:-Rediet Shimelis
ID NO_:-DBUE799/11

2. “UDP flood attack” is a type of Denial of
Service(DoS) attack in which the attacker
overwhelms random ports on the targeted host
with IP packets containing UDP datagrams.

3. User Datagram Protocol (UDP) is a connectionless
and sessionless networking protocol.
Since UDP traffic doesn’t require a three-way
handshake like TCP, it runs with lower overhead
and is ideal for traffic that doesn’t need to be
checked and rechecked, such as chat or VoIP.

4. UDP Flood Attack Tools:
• Low Orbit Ion Cannon
• UDP Unicorn
This attack can be managed by deploying firewalls at key
points in a network to filter out unwanted network traffic.
The potential victim never receives and never responds to
the malicious UDP packets because the firewall stops them.
However, as firewalls are 'stateful' i.e. can only hold a
number of sessions, firewalls can also be susceptible to
flood attacks.

5. There are ways to protect a system against UDP flood attacks. Here
are examples of some of the possible measures:
• ICMP rate-limiting: This limitation is generally placed on ICMP
responses at operating system level.
• Firewall-level filtering on the server: This enables suspicious
packets to be rejected. However, it is possible for the firewall to
collapse under the strain of a UDP flood attack.
• Filtering UDP packets (except for DNS) at network level: DNS
requests are typically made using UDP. Any other source
generating huge amounts of UDP traffic is considered suspicious,
which leads to the packets in question being rejected.

6. How is a UDP flood attack mitigated?
Most operating systems limit the response rate of ICMP packets
in part to disrupt DDoS attacks that require ICMP response. One
drawback of this type of mitigation is that during an attack
legitimate packets may also be filtered in the process.
If the UDP flood has a volume high enough to saturate the state
table of the targeted server’s firewall, any mitigation that occurs
at the server level will be insufficient as the bottleneck will occur
upstream from the targeted device.

7. How to Stop a UDP Flood Attack?
Stopping a UDP flood DDoS attack can be challenging. Most operating
systems attempt to limit the response rate of ICMP packets with the goal of
stopping DDoS attacks. The downside to this form of mitigation is that it
also filters out legitimate packets. In the case of a truly high volume flood,
even if the server’s firewall is able to mitigate the attack, congestions or
slowdowns will in-all-likelihood occur upstream, causing disruption
anyway.
Anycast technology, using deep packet inspection, can be used to balance
the attack load across a network of scrubbing servers. Scrubbing software
that is designed to look at IP reputation, abnormal attributes and
suspicious behavior, can uncover and filter out malicious DDoS packets,
thus permitting only clean traffic to make it through to the server.

8. How to Prevent a UDP Flood Attack?
Preventing a UDP flood attack can be difficult. Most
operating systems attempt to limit the response rate
of ICMP packets with the goal of stopping DDoS attacks.
Anycast technology is a network addressing and routing
method in which incoming requests can be routed to a
variety of different locations. It can be used to balance the
attack load across a network of scrubbing servers.
Scrubbing software that is designed to look at IP reputation,
abnormal attributes and suspicious behavior, can uncover
and filter out malicious DDoS packets, thus permitting only
clean traffic to make it through to the server.

9. THANK YOU!!!