User Datagram Protocol

• UDP Denial of Service
• UDP Based Protocols
• UDP Header

The User Datagram Protocol (UDP) is a transport layer protocol used extensively in networking, particularly where speed is prioritized over guaranteed delivery.

Here is a comprehensive overview of UDP drawn from the sources, covering its characteristics, common applications, and security implications:

1. Characteristics and Functionality

UDP is fundamentally a connectionless protocol. Unlike TCP, UDP is designed to carry short messages over a computer network and provides an unreliable service.

Key features related to its structure and use include:

• Connectionless Nature: UDP avoids the overhead associated with establishing and maintaining a connection (like the TCP handshake).
• Packet Structure: For IPv4 DHCP messages, the UDP header fields, along with IP addresses and ports, are part of the header information analyzed during network flow clustering for detection techniques.
• Efficiency: UDP scans are described as having no overhead of a TCP handshake, which is an advantage when seeking information quickly, although this advantage is often counteracted by the slow nature of UDP scanning itself due to ICMP rate limiting.

2. Common Applications and Ports

UDP is utilized by various network services, especially those sensitive to delay or those that prioritize real-time transfer.

UDP is commonly applied in applications such as Audio streaming and Videoconferencing and teleconferencing.

2. UDP in Reconnaissance and Scanning

UDP is essential in network mapping and host discovery, particularly when TCP or ICMP are filtered.

A. UDP Traceroute Traceroute programs, especially those running in Linux (using the default traceroute command) or specialized tools like NetScanTools Pro, can use the UDP protocol to trace the route to a destination.

B. UDP Scanning UDP scanning checks the UDP ports of a target system to determine if services are running or in a listening state.

• Mechanism: UDP port scanners send UDP packets (often empty, but sometimes protocol-specific payloads for common ports like 53, 161/162, 67/68) to target ports.
  • If the target port is closed, the IP stack usually returns an ICMP port unreachable packet.
  • If the target port is open or filtered (firewalled), no response is typically received. UDP scanners interpret lost traffic as open ports.
• Tools and Syntax: Nmap activates a UDP scan with the -sU option. For host discovery specifically, Nmap uses the UDP ping scan (-sn -PU), typically defaulting to the highly uncommon port 40,125.
• Challenges: UDP scanning is generally slower and more challenging than TCP scanning. It is less informative regarding an open port because there is no required acknowledgment response. The efficiency of UDP scans is low due to the potential for ICMP rate limiting imposed by operating systems compliant with RFC 1812. However, UDP scans can be efficient on Microsoft-based OSs, which typically do not implement ICMP rate limiting.

3. Security Vulnerabilities and Attacks

UDP is frequently leveraged in various attacks, especially Denial-of-Service (DoS) attacks, due to its connectionless nature.

A. Denial-of-Service (DoS) Attacks UDP flood attacks fall under the category of volumetric attacks, which aim to exhaust network bandwidth.

• UDP flood: An attacker sends a large volume of spoofed UDP packets to random ports on a target server. The server expends resources repeatedly checking for nonexistent applications at those ports and replying with ICMP "Destination Unreachable" error packets, ultimately consuming available bandwidth and causing the network to go offline.
• Amplification Attacks: Several UDP-based protocols are targeted in amplification attacks, where a small query results in a large reply being directed to the victim using a spoofed source IP address. Examples of UDP-based application layer protocols exploitable for flooding include NTP, SNMPv2, TFTP, and VoIP.
  • A primary example is the NTP amplification attack, where UDP packets spoofing the victim's IP trigger requests (often via the monlist command) that generate large response packets back to the victim.

B. Session Hijacking and Spoofing UDP is susceptible to hijacking, known as UDP Hijacking. Because UDP lacks synchronization or sequencing, a UDP session can be attacked more easily than a TCP session.

• Mechanism: An attacker uses a man-in-the-middle (MITM) attack to intercept the client's UDP request and forges a reply, sending it to the client before the legitimate server can respond.
• Exploits: UDP hijacking involves spoofing the source IP address, intercepting the traffic, or manipulating unauthorized requests.

C. Evasion and Tunneling UDP is used in evasion techniques because it is often less scrutinized than TCP traffic.

• DNS Tunneling: This effective technique for bypassing firewalls and IDS leverages DNS, which operates using UDP on port 53. Attackers embed malicious data within DNS queries and responses to exfiltrate data, as security mechanisms often trust DNS traffic.
• Firewalking: UDP packets can be used in firewalking, a technique involving setting the TTL value one hop greater than the targeted firewall to analyze responses and determine ACL filters.
• Defense: Using the UDP source port randomization technique can defend servers against blind response forgery.