What Is a UDP Flood DDoS Attack?

UDP flood is a type of denial-of-service (DoS) attack designed to render a system, server, bandwidth, or machine unavailable for legitimate users and requests. A sessionless protocol, UDP floods are highly effective and require few resources to execute. DoS or DDoS (distributed denial-of-service) attacks are often part of highly complex threats that combine multiple attack vectors (aka multi-vector), to target an organization’s IT environment. Unlike TCP DDoS attacks, where threat actors leverage TCP SYN packets, UDP packets can be fragmented and cause as much harm as a normal UDP flood attack.

The networking protocol User Datagram Protocol (UDP) enables computer applications to send messages, or datagrams, to other hosts via an IP address or network. When a UDP packet is received by a server, its operating system checks for related applications and, if none are found, informs the sender with a “destination unreachable” reply packet. Unlike TCP’s connection or session orientation, UDP is a connectionless protocol and the server uses the Internet Control Message Protocol (ICMP) response to serve notice that the original UDP packet cannot be delivered.

To initiate a UDP flood attack, attackers send large amounts of UDP traffic with spoofed IP addresses to random ports on a targeted system. Because the system must check the port specified in each incoming packet for a listening application and issue a response, the targeted server’s resource can quickly be exhausted, rendering it unavailable to normal traffic and legitimate users. Internet connections can easily become congested and saturated. When UDP packets are malformed with small header attack payloads, this increases the packets-per-second rates and can cause the hardware on internet network cards to fail.

Preventing UDP flood attacks can be a challenge. Operating systems may attempt to limit the response rate of the ICMP packets that are part of UDP responses. But this approach is indiscriminate and may filter out legitimate traffic as well. Mitigating any type of DDoS should be done furthest away from the data center or origin, where these attack tools are less effective. SIP and VOIP internet services rely on the UDP stack and are uniquely susceptible to these types of attacks. UDP flood attacks can be generated from botnets, but attackers leverage open UDP protocols that easily reflect and amplify attacks toward services like web, DNS, SSH, SCP, SSL, TLS, and other hosted internet resources.

Along with Prolexic, Akamai offers additional solutions for DDoS protection.

App & API Protector

Akamai App & API Protector is holistic web application and API protection architecture and is designed to defend entire TCP web and API estates with an industry-leading focus on automation and simplicity. This solution brings together core technologies including API security, web application firewall, bot mitigation, and DDoS protection. App & API Protector defends against a broad range of threats, including volumetric DDoS attacks like UDP floods and ICMP floods, injection and API-based attacks, application-layer attacks like Slowloris, and protocol-based threats like TCP out-of-state attacks, SYN floods, or ACK floods that require legitimate users to complete the three-way handshake.

Prolexic

Akamai Prolexic stops UDP flood attacks with a zero-second SLA and the fastest, most effective defense at scale. Prolexic provides cloud-delivered mitigation across all ports and protocols to stop attacks in the cloud before they become business-impacting events. With Prolexic, network traffic is delivered to one of 20+ global high-capacity scrubbing centers, where we can stop attacks closer to the source to maximize performance for users and ensure network resiliency through cloud distribution. At each scrubbing center, the Akamai Security Operations Command Center (SOCC) uses proactive and/or custom mitigation controls to stop attacks instantly, returning clean traffic to the customer origin.

Edge DNS

Akamai Edge DNS is a cloud-based DNS solution that leverages Akamai Connected Cloud to provide access to thousands of DNS servers in more than 1,000 points of presence worldwide. With Edge DNS, organizations no longer need to rely just on two or three DNS servers, a common practice that leaves organizations vulnerable to data center outages and DDoS attacks. This Akamai solution can absorb the largest DDoS attacks while continuing to respond to legitimate user requests, improving DNS resiliency and responsiveness.