What Is a UDP Flood DDoS Attack?

What is a UDP flood DDoS attack?

A UDP flood is a volumetric DDoS attack that sends a huge number of User Datagram Protocol (UDP) packets at a target, often to many different ports, until the target's bandwidth, firewall or CPU is used up and real traffic cannot get through. UDP has no handshake, so the sender can lie about its address and the target cannot tell friend from foe. This entry explains the mechanics and the defences. It is not a guide to launching one: attacking systems you do not own is illegal.

Why UDP is easy to abuse

UDP is defined in RFC 768 as a datagram protocol where "delivery and duplicate protection are not guaranteed". There is no connection setup, and the source port is even optional. Nothing in the protocol checks that the source IP address belongs to the sender, so a packet with a forged address is accepted like any other.

How a UDP flood works

• Direct flood. Many machines, usually a botnet, send UDP packets to random ports on the target. For each packet the host looks for an application on that port. When none is listening, it may answer with an ICMP "destination unreachable" message (port unreachable, defined in RFC 792), which adds outbound load on top of the inbound flood.
• Reflection and amplification. The attacker sends small requests to public UDP servers with the victim's address forged as the source. The servers send their larger replies to the victim. CISA's UDP amplification alert (TA14-017A, archived) lists bandwidth amplification factors such as 28 to 54 for DNS, 556.9 for NTP and 358.8 for CharGEN, and up to 51,000 for Memcached.
• Spoofed sources. Because the source address is forged, blocking by IP address rarely helps and the real origin is hard to trace.

Reflection attacks have their own entries: DNS amplification and Memcached DDoS.

Example

A game studio runs a server on one UDP port. Traffic jumps to several times the size of its internet link, almost all of it small UDP packets from spread-out addresses. The link is full before any packet reaches the firewall, so the firewall rules on the server make no difference. The studio needs its provider to filter upstream.

How to defend against a UDP flood

• Absorb it upstream. A flood that fills your link cannot be fixed on your own server. Use a DDoS protection service or a provider that scrubs traffic before it reaches you. CISA also lists BGP-based remotely triggered blackholing, coordinated with upstream providers, as an option for victims.
• Close what you do not use. Block UDP ports that no service needs and only expose the services you run. Stateful UDP inspection helps at the border.
• Do not become an amplifier. Turn off unneeded UDP services, apply response rate limiting to DNS and other UDP services, and never leave open resolvers or Memcached reachable from the internet.
• Stop spoofing at the source. Network operators should apply ingress filtering as described in BCP 38 (RFC 2827), which drops packets whose source address does not belong to the network they come from.
• Watch your traffic. Alert on sudden jumps in UDP volume, unusually large responses to one address and packet-size anomalies in flow data.

The wider playbook is in how to stop DDoS attacks. A UDP flood is the network-level counterpart of an HTTP flood, which targets the web application instead.

Common mistakes

• Relying on a server firewall against a flood that saturates the network link before the firewall sees it.
• Running public DNS, NTP or similar UDP services with default settings, which makes you part of someone else's attack.
• Having no contact path and no plan with the hosting provider until the attack has started.

Where LoadFocus fits

LoadFocus does not simulate attacks, including UDP floods. Its load tests send HTTP and HTTPS requests from 25 cloud regions, and a volumetric UDP attack has to be absorbed upstream by your hosting or DDoS-protection provider. What a load test does show is how your web application behaves as legitimate traffic grows, so you know your real capacity and your headroom. See load testing vs stress testing and spike testing for how to plan that. Only test systems you own or have written permission to test, and check your hosting provider's testing policy first.

FAQ

What is a UDP flood in simple terms?

It is an attack that sends a very large number of UDP packets at a target so that its network link, firewall or server runs out of capacity and legitimate users cannot connect.

Why can attackers forge the source address in UDP?

UDP has no connection handshake and does not verify who sent a packet, so a packet with a forged source address is accepted. That is why reflection attacks work and why ingress filtering (BCP 38) matters.

Can a firewall stop a UDP flood?

Only partly. A firewall can drop UDP traffic to ports you do not use, but a flood big enough to fill your internet link must be filtered upstream by your provider or a DDoS protection service.

Does LoadFocus simulate UDP floods?

No. LoadFocus load tests send HTTP and HTTPS requests to measure how your application performs under legitimate load. It does not run attack simulations.