A UDP flood is a type of denial-of-service attack in which a large number of User Datagram Protocol (UDP) packets are sent to a targeted server with the aim of overwhelming that device’s ability to process and respond. The firewall protecting the targeted server can also become exhausted as a result of UDP flooding, resulting in a denial-of-service to legitimate traffic.

How does a UDP flood attack work?

A UDP flood leverages the procedural response of a server to incoming UDP packets at its ports. Ordinarily, upon receiving a UDP packet, the server undergoes a two-step verification process:

1. It first identifies whether there are any active programs poised to accept requests on the targeted port.
2. Should it find the port devoid of listening programs, the server issues an ICMP (ping) packet back to the originator, signaling the unreachability of the destination.

This process can be analogized to a hotel receptionist managing incoming calls. Upon receiving a call, the receptionist checks whether the requested guest is present and accepting calls. Discovering the guest’s unavailability, the receptionist must inform the caller of their inability to connect the call. The scenario becomes overwhelming when multiple calls flood in simultaneously, each requiring the receptionist to verify availability and respond accordingly—this is the crux of a UDP flood attack, aimed at inundating the server with futile packet checks and responses.

Whenever the server receives a new UDP packet, it processes the request, using server resources along the way. Each UDP packet sent includes the sender’s IP address. In a DDoS attack of this kind, attackers typically hide their actual IP address by falsifying (or “spoofing”) the source IP address in the UDP packets. This tactic prevents the attacker’s true location from being revealed and avoids the possibility of their location being overwhelmed by response packets from the server they’re targeting.

As the server expends resources to verify and respond to each UDP packet, its resources can be quickly depleted if a massive volume of UDP packets is sent its way. This can lead to a denial-of-service for legitimate traffic, as the server becomes overwhelmed.