DEMO: UDP Flood Attacks

TCP Versus UDP

Two protocols that are very common that we use nowadays are TCP and UDP, but they serve very different purposes. TCP has a lot of features — things like it controls the flow, and also there's some sort of error checking involved with it that allows us to retransmit data if there are any kind of issues or something doesn't get to the other side. So TCP is a great way to implement very reliable transmission, versus UDP, which is meant for speed, very small bits of data. We use it on things like voice over IP and video conferencing, versus TCP is where we need more reliability, like downloading software and browsing the web.

Here's what the fields of a TCP header look like. In here we can see that there are quite a few different fields where we can specify different things. So lots of options with all of this, and lots of features that come with how TCP is designed.

UDP looks quite a bit different. There are only four fields in this UDP header. One common application for this would be like phones. Phones are meant to send a bunch of small packets, and it's really important that these get over to their destination on time. That's one of the reasons why they're small and they just send over real quickly, without all that overhead and extra features that TCP has.

The UDP Flood Attack

What makes this attack even more effective is that the server tends to reply with this ICMP destination unreachable. In other words, if these packets make it over to the server, the server checks those UDP ports and says, "Oh, I don't have that port even available, so I'm going to reply back and say, yep, that's not available." This takes extra time and computing effort for that machine, and it also has to send that out, eating up its bandwidth and eating up its resources so it can't reply to others.

So we can easily carry out this attack by sending out a flood of UDP packets to some sort of port asking for those services. It's going to send back an ICMP destination unreachable reply, and therefore eat up all of those resources.

The Demonstration

I'm going to actually show you how to carry out this type of attack. Remember, this is for ethical hacking purposes only, so only do this on your network, or a network that you've gotten permission to carry out this type of an attack on.

I'm on my demo laptop here, and as you can see, we're connecting to 10.1.30.23. I can hit refresh and we can see that the site is up and running — it loaded instantly, pretty much. Here on the right hand side, I'm also pinging this. So let's pull up a Kali Linux box and do this UDP flood attack and see what happens.

I'm going to hit the up arrow, because we're going to use pretty much the same command that I used in another lesson. It's got the hping3. We're pinging the address of the server. We're flooding it, so that way we can send more than one request at a time. We are doing it from a random source address, and in this case right here we're going to change the destination port to 69, which is TFTP. And we're going to change from a SYN attack — here we're going to do UDP, so we'll type in UDP. We'll hit Enter. I do need to put the password in here.

And we can see that we brought down the service here: it's timing out. I can hit refresh. So here again, this is an effective attack — we are not receiving any messages back.

So I'm going to bring back that Kali box and hit Control-C to exit out of that. And then we see that it comes back up, and we can hit refresh and it refreshes instantly again. So there you have it, that's a UDP attack.

So here's that UDP flood attack card. We are overwhelming a device's resources. We're just flooding it with a bunch of UDP packets, and therefore then it can't respond to legitimate traffic.