UDP

What Is UDP?

UDP measures the sending rate per source and recognizes two known attack forms from their signature. The band is on the L4 DDoS Management screen and its explanation note gives its scope in a single line: UDP floods and known UDP service signatures.

UDP has no handshake: the sending side does not wait for an acknowledgement from the other side and no session is established. This separates the method of the band from TCP. While the TCP band can measure the rate at which the connection is established and its staying open, in UDP the only thing that can be measured is the sending rate itself. For this reason the band brings two separate approaches together:

Box	What it looks at
UDP Flood	The sending rate of the source: how many new UDP packets are sent per second and how many of them are DNS requests.
UDP Signatures	The signature of two known UDP attacks: the packets whose payload is completely empty and the attack directed at the file sharing ports.

4

Rules

UDP Flood 2 · UDP Signatures 2

4

Able to Send to Quarantine

All four can take the source into quarantine

3

Adjustable Limit

Three rules have a limit per second; the one of the empty packet rule is fixed

2

Exempt from the Promotion Permission

The signature rules can promote into enforcement while the Mode Promotion permission is off as well

4

Carrying a Learning Lock

All four carry a Learning Lock switch because they produce measurements

In Force

In an Untouched Table

The catalog defaults are written together with the table: two rules Monitor, two rules Block

The band has no setting of its own

The band and the boxes carry no editing element: neither a mode selector nor a pencil icon is found. Every rule is adjusted with the pencil in its own row, in its own edit window.

The UDP Band on L4 DDoS Management

The band is located right below the TCP band. In the header there are the name of the band, the number of rules it carries in parentheses and below it the explanation note; at the top right there are the mode distribution badges.

L4 DDoS Management - The UDP Band

Element	Meaning
The title and the number	The name of the band and the number of rules in it: UDP (4). This number is fixed; the band carries the same four rules in every route table.
The explanation note	The fixed text that summarizes the scope of the band.
The distribution badges	The mode distribution of the four rules of the band: Enforcing, Monitoring and Off. A badge whose number is zero is not displayed.
The two boxes	In the header of every box there are its name and the number of rules it carries.

In this band the number on the band and the number on the status card count the same set

In the TCP band the counter of the band and the counter of the status card count different sets; there the two on/off settings enter the column of the band but not the column of the card.

In the UDP band there is no such difference: all four of the four rules use the enforcement levels. The number in the Enforcing column of the band gives the number of rules that can really drop packets.

Rule Modes

All four rules in the band use the same value set: Disabled · Monitor · Block · Quarantine. A setting with an on/off structure is not found in this band.

The color of the row is the color of the mode

At the beginning of every rule row there is a status dot and its color shows the mode of the rule:

Mode	Dot
Block and Quarantine	Green
Monitor	Amber
Disabled	Dim gray

The action word inside the sentence is colored separately: amber in the monitoring mode, red in the enforcement mode.

The default value and the value the box is born with are not the same thing

In the rule catalog these four rules also have a default value and these values are in force: the catalog defaults are written to the table while the route table is being created and in the configuration check at device startup, and in addition, in every network write the fields whose value remains undefined are filled again.

For this reason, in a route table that has never been touched, the band does not read Off 4. The two flood rules are born Monitor and the two signature rules Block; the band reads Enforcing 2 · Monitoring 2.

The way to return all the rules to the catalog defaults at once is the returning to the default operation on the Learning strip.

Badges on the Row

At the right end of the rule row, where the sentence ends, there are small indicators. Their order from left to right is fixed: padlock → pencil → verdict badge.

Indicator	What it is	When it is seen
Padlock	A lock icon without a word, on its own. It is the operator's Learning Lock switch.	While the learning lock of the rule is on.
Pencil	It opens the edit window of the rule.	While there is change authorization.
Verdict badge	A clickable badge carrying an icon and a word. It is the verdict of the learning engine about this rule in the last round.	If the engine has run at least one round.

The verdict badge shows one of four words:

Badge	Icon	What it tells
Suggestion		The engine has a recommendation for this rule waiting to be applied.
Locked		There is a change the engine wants to apply, but a setting does not allow this.
Learning		The engine does not have a word to say for this rule yet; either enough data has not accumulated or the attack and the usual traffic could not be separated.
Verified		The engine looked at the rule and decided that the current setting is in place.

When the pointer is moved over the badge, the meaning of the badge, the line that starts with If applied: … and shows the sentence of the setting when it is applied (if the engine has a recommendation) and the Click for the details and to apply hint are displayed. When the badge is clicked, the recommendation window that shows the justification of the engine and, if there is one, the new sentence it recommends opens.

The Locked badge and the padlock icon are not the same thing

Both of them carry the lock icon, but they tell different things and stand in separate places in the row.

The padlock icon is the operator's own decision: the Learning Lock switch of the rule is on, the engine cannot touch this rule. It is without a word and stands on the left of the pencil.

The Locked badge is the complaint of the engine: there is a change the engine wants to apply, but a setting is obstructing this. It carries a word and stands on the right of the pencil. The obstacle can have two sources:

The source of the obstacle	What has happened
The rule's own lock	The Learning Lock switch of the rule is on. The engine has a ready recommendation, but the recommendation of a locked rule is not counted as applicable.
A door the operator can open	The Mode Promotion permission is off. The exemption list being empty is counted in this band as a warning, not an obstacle; the management access exemption list obstacle occurs only in the TR7 management port rules.

In the first case there are both the wordless padlock icon and the Locked badge in the row; in the second case there is only the badge. That is, the badge alone does not mean "this rule was locked manually" but "the engine has a change and it cannot be applied".

Edit Window

The pencil that comes right after the sentence in every row opens the rule's own edit window. The title of the window is in the form Rule settings · <rule name>.

Element	When it is found
The information band	In every rule. It shows the catalog definition of the rule.
Status	In every rule. The same four values are offered in all four.
Learning Lock	In every rule. Since all four rules of the band produce measurements, the switch is found in all four.
Limit per Second	In three rules. It is not found in the empty payload packet rule; its threshold is fixed.
Save	In every rule. It is inactive while there is a validation error.

The saving updates only the changed fields and takes effect immediately. If no field has changed, the request is not sent.

Rules in the Box

UDP Flood

The limit of new UDP packets per second per source and the separate limit applied to the DNS requests.

→

UDP Signatures

The UDP packets whose payload is completely empty and the SMB attack directed at the file sharing ports.

→

Scope and Limits

INFO

• The band is displayed with the same four rules in every route table. The rules do not change according to the route table; only their modes and limits change.
• The band and the boxes have no editing element of their own. The editing is in the pencil of every row.
• All four rules can send a source to quarantine.
• In an untouched route table the catalog defaults are in force: the two flood rules are born Monitor and the two signature rules Block.
• Not every rule related to UDP traffic is in this band. The limit of the UDP services used in reflection and amplification attacks is in the ICMP & Reflection band.
• The measurements do not separate the IP versions. The counter of a rule counts the IPv4 and IPv6 traffic together.
• The settings are per route table and are written to both devices in a cluster; the measurements and the quarantine lists, on the other hand, are per device.
• The sources in the exemption list are not caught by any rule of this band and are not written to its measurements either.
• The editing requires change authorization in the Network area. With a monitoring-only authorization the band and the sentences are displayed, the pencil icons are not displayed. While the network configuration is locked during synchronization, the editing is closed as well.