One thing that I don't understand about peer to peer botnets, is how a bot stays connected to the network considering the protocol used is UDP.

Since the UDP is connectionless, and the bot is behind a firewall, the packets wouldn't reach it. What would happen then?

  • 1
    when I Google "UDP p2p" one of the first hits is en.wikipedia.org/wiki/UDP_hole_punching - I believe this answers your question.
    – schroeder
    Commented Mar 31, 2016 at 23:55
  • While applicable to NAT, this still doesn't answer my question in the firewall department (article never mentions firewalls). Also, UDP hole puching is still not reliable afaik, so there should be some backup?
    – user106192
    Commented Apr 1, 2016 at 0:51

2 Answers 2


P2P botnets deal with firewalls the same way as all the other P2P applications (like Bittorrent, Skype and other VoIP, ...) do:

  • Simple NAT firewalls can be passed with UDP hole punching techniques
  • With more complex firewalls, like application layer gateways which only allow HTTP traffic, it either fails or it uses some outside server as a relay for communications.

Failing in case of more restrictive firewalls is actually not that much of a problem for P2P bots because most users are either not protected by any firewall at all or only by simple and easy to bypass packet filters.

  • You mean for the relay part, it's actually just some kind of VPN with http traffic? Since all other traffic is blocked.
    – user106192
    Commented Apr 1, 2016 at 6:17
  • @j0ach1mmall3: VPN is completely unrelated. It just sends the data to some external server which then forwards them to some other host. There is no need for encryption or private IP addresses. I recommend that you have a look at how VoIP SIP deals with such issues, i.e. STUN, ICE and TURN. Commented Apr 1, 2016 at 6:28
  • @SteffenUllrich I'm curious now - could you tunnel UDP Traffic over a VPN to bypass less restrictive firewalls?
    – user115400
    Commented Aug 18, 2017 at 17:10
  • @NathanielSuchy: Please don't ask a new question in a comment. Apart from that one can tunnel TCP, UDP, ICMP, ... inside a real VPN. Commented Aug 18, 2017 at 17:25
  • @SteffenUllrich Sorry I thought I was asking for clarification. I'll be sure to ask a new question next time.
    – user115400
    Commented Aug 18, 2017 at 17:32

If the system connected to a botnet (in most cases added due to a malware infection) is behind a firewall traffic may still reach it depending on our your firewall is configured.

If no application you use on your network requires UDP access you could drop the protocol entirely with your firewall.

However, you will still need to address UDP Hole Punching techniques to completely block off UDP Traffic, and some malware may utilize these techniques. Stopping UDP Hole Punching will require highly restrictive firewall rulesets. See https://stackoverflow.com/questions/28790503/are-there-security-measures-against-udp-hole-punching for more information on this.

You must log in to answer this question.