Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
Okay,if i wanted to prevent a udp flood are these 2 solutions sufficient:
-Say that i have only one port open like port 80 however i never use udp interactions what if i blocked the udp port leaving only the tcp.
-Say that i have gained a log containing 100 ips that ddos me what if i blocked these ips in my firewall would they be still able to hurt my connection if their upload rate is high?
These bandwidth-exhaustion attacks can't be prevented.
You can indeed use your firewalls to drop the packets before they reach your application and trigger a response (if the packets are valid and not pure garbage) so you don't waste resources and outbound bandwidth by replying to them, but the packets will still use and possibly overload your downstream connection which means packets from legitimate users won't be able to reach you.
The only real solution against this is to have more bandwidth than the attacker, either by yourself (if you're a big company you have the money to do this, and doing it yourself is beneficial for some companies like ISPs who need lots of bandwidth anyway) or using a service like Cloudflare who acts as a proxy between the Internet and your servers, so any attack will hit their network and they have enough bandwidth to survive it.
With the capability of UDP based DDoS attacks today (400Gbps attacks using NTP based vulnerability), my guess is that firewalls will start to falter as well.
There isn't really a reliable solution for UDP based DDoS prevention except hoping (against hope) that ISPs persevere to enforce BCP38 recommendations, which prevent network packets not belonging to the autonomous system, to not be transmitted.
