Questions tagged [udp]
UDP (User Datagram Protocol) is a simple connectionless transmission model formally defined in RFC 768.
75
questions
0
votes
2answers
74 views
Why do firewalls focus on tcp and udp?
From what I can see, most firewalls seem to focus on tcp and udp. Why is that? Is it impossible or at least very unlikely for malware to use other protocols/custom protocols?
0
votes
2answers
87 views
Is UDP used for applications that require less security?
We often hear TLS over TCP socket and very famliar with its use case e.g. HTTPS.
While I am learning Linux socket progamming, I read a An Introduction to OpenSSL Programming, Part I of II tutorial . (...
1
vote
1answer
45 views
UDP amplification: length(response_packet) < length(request_packet)
I was researching the GitHub DDoS attack of 2018, in which memcached UDP amplification was used. I noticed that a GitHub blog post referenced a CloudFlare post which described memcached-based UDP ...
0
votes
1answer
3k views
What is this service? [closed]
Fairly new to infosec and am going through a course on nmap. While scanning I found this and it looked interesting and was wondering if you all had any information on this?
This is the port,state and ...
1
vote
2answers
584 views
Do I have to block UDP ports when I launch my own server with a public IP?
I am trying to give better security to my Raspberry sever. When I installed UFW, I allowed just port 80/tcp and my own high port for SSH communication, and by default are all others ports "deny".
...
1
vote
1answer
28 views
Why do processes on servers have socket types associated to the port number? [closed]
Why do some servers have TCP/UDP alongside the port they're listening to. To my understanding TCP and UDP are socket layers, they're methods of determining how the traffic is being sent over the ...
-2
votes
1answer
329 views
What is the difference between DNS flood attack and UDP flood attack?
As title says, what is the difference between DNS flood attack and UDP flood attack?
Plus, do they only exhaust the network bandwidth or do they also exhaust the server-side assets such as CPU, ...
1
vote
1answer
411 views
Encrypting UDP? (not using DTLS)
We are exploring options on encrypting messages to 3rd party devices which operate on UDP messages.
Since each vendor will need to implement the encryption-decryption process as well, we would like ...
0
votes
2answers
337 views
How does DTLS replace the transport encryption of TLS? [duplicate]
I've been reading the RFC for DTLS over UDP, but can't seem to understand, how the transport encryption aspect of TLS was handled. It reads to me, like they just didn't bother, since there can be ...
1
vote
1answer
44 views
is -nU an option with nmap?
My coworkers seem to have -nU (no udp) as an option for their nmap scripts but I've never seen this in use and when I try to use this option with nmap, it does not work. I thought no udp was enabled ...
2
votes
2answers
161 views
One way protocol with encryption without tcp
I am trying to brainstorm how I might either:
1) create a protocol (although against this option)
2) use an existing protocol
That does the following:
1) allows 1 way communication from 1 node to ...
0
votes
1answer
2k views
Vulnerabilities of DNS when utilized on a TCP port
There was some specific cyber security challenge (Cyber Cube 2018, GE). In one of the tasks, objective was to gain the access to some specific file that server included.
After successfully solving ...
1
vote
0answers
60 views
Machine reaching out to Microsoft IP address using NBTstat command
I have limited logs for this event but the IPS says its a NBTstat query outbound over UDP port 137 to a Microsoft owned IP address.
Should UDP 137 ever reach out externally?
This is about all the ...
2
votes
1answer
206 views
Security implications of setting the broadcast flag on a UDP socket
Are there any negative security effects of setting the SO_BROADCAST option in a C UDP socket? I'm writing a C program and if I just set the broadcast option to 1 then all IP addresses work as intended,...
2
votes
3answers
1k views
UDP vs ICMP flood
How can we measure the efficiency of the flood technique? Will it be by the number of bots required for flooding the link? In case of UDP and ICMP, which one would be more efficient and why?
1
vote
2answers
571 views
Why is spoofing allowed in reputed VPS services?
I just learned about IP spoofing and so I set up VMs and sent spoofed UDP packets (8.8.8.8, Facebook's IP, Twitter's IP) to myself (home PC and mobile) from well-reputed VPS providers like AWS, ...
2
votes
2answers
1k views
How many UDP packets is too many?
My Company recently got hit by a spam email with a link that executed an .exe file. Apparently our Antivirus stopped it from executing (Symantec enterprise).
I'm no security expert, but I am a ...
3
votes
2answers
677 views
UDP flood 300 Kbps + SYN probes / other attacks. Flood or DDoS at low rate?
So for over 2 weeks, Im receiving what appears a combination of attacks non-stop 24/7.
First this UDP flood at a strangely small rate of 280 Kbps / 110 pps (360 bytes length)
02:29:41.978484 IP (tos ...
-3
votes
2answers
2k views
Insecure/Obsolete TCP/UDP Ports? [closed]
I used CurrPorts to monitor TCP/IP network connections. This image shows when I don't connect to the Internet but I don't know why Avast Antivirus established this port. Is it insecure?
This image ...
2
votes
1answer
190 views
How to handle UDP abnormally disconnection in DTLS？
DTLS-UDP is used between client and server.
If the client ends abnormally，how does the server know that the client is gone?
i have read rfc6347 and find nothing about that.
thanks in advance.
0
votes
1answer
280 views
If TCP is more “secure” than UDP, how would a practical UDP “attack” look, for example during the initiation of a MS RDP connection?
In accordance to the recent question Why is TCP more secure than UDP?. How would an "attack" look when it comes to the practical aspect? A great example would be the use of TCP or UDP for Microsoft ...
58
votes
12answers
36k views
Why is TCP more secure than UDP?
During reading MS SDL presentations I found a recommendation to replace UDP by TCP in applications because TCP is more secure than UDP. But both of them are only transport layers, nothing more.
So ...
0
votes
1answer
323 views
How to block an application with iptable which use random port
Scenario:
My goal was to allow TeamViewer to connect to my home workstation from my laptop only. So I have tried to bind my laptop's MAC with an IPtables rule as following,
[arif@arif:~]$ sudo ...
1
vote
0answers
90 views
Spoofing an IP/MAC address to avoid ICMP Destination Unreachable being sent back [duplicate]
As far as I understand UDP flooding the idea is to send UDP packets across all ports from e.g. Alice to Bob, and get Bob's machine to check who listens to certain ports and generate many ICMP ...
2
votes
2answers
1k views
Using IPsec through NAT
I have read that it is recommended to encapsulate IPsec packets into UDP (port 4500) packets in order to circumvent NAT. Could anyone please provide a detailed explanation of the reasons behind this ...
2
votes
2answers
1k views
Authenticate a user thru a UDP socket
so let's say I had a basic socket, doesn't give you any information about the user other than the IP address, what would be my options If I wanted to authenticate a user in the most optimal way ...
3
votes
2answers
3k views
Windows firewall settings to receive UDP and pings
I use a windows 10 to receive UDP packets or pings from another computer which runs Win/Mac/Linux.
I default, I turn off the firewall to receive pings or packets.
I prefer not to turn off the ...
2
votes
1answer
488 views
Is it possible to scan the top X UDP ports and the top Y (X!=Y) TCP ports in Nmap using a single command?
Given X!=Y, is there any way to scan the top (--top-ports) X TCP ports and the top Y UDP ports using a simple Nmap command?
The --top-ports parameter affects both the TCP and UDP scans (e.g., when -...
2
votes
2answers
142 views
Does the choice of protocol affect the efficiency of a DOS attack?
I was wondering, to make a DOS attack you need to send something to the target you are DOS-ing. And to send something you need to use some protocol. My question is, are all protocols the same speed? ...
3
votes
2answers
5k views
How realistic is it to spoof a specific UDP IP address? [duplicate]
Let's say that I'm a malicious user Bob and I have found a vulnerability in an application that will allow me to impersonate another user, Alice. Alice is connected to 'X' server with her IP address (...
2
votes
1answer
209 views
Client security using UDP
Introduction
I am currently trying to build up a networking layer for Unity from scratch. Currently I am testing the communication via UDP using Node.js for the server and the client. However I guess ...
5
votes
1answer
1k views
Is it possible to successfully send a spoofed UDP header with a completely unrelated source IP?
I've read that many networks use ingress/egress filtering to eliminate the number of spoofed UDP packets sent and received by their network.
Given that network provides have been much more diligent ...
2
votes
1answer
276 views
What is UDP port 56183
We seen suspicious probing from source port 53 to destination port 56183. May I know what services use port 56183 (udp)?
2
votes
1answer
75 views
Is it possible to get All IP's that belongs to given zip code? [closed]
For this kind of things can use Country IP blocker , but it only gives whole country IP's, so what im asking is , Is there any way to get All IP's that belongs to given Zip code?
2
votes
1answer
2k views
Does a Server connecting to port 3544 pose an increased risk
I had look at the firewall logs and i can see my production server connects to microsoft (13.92.90.48) on UDP port 3544. A quick reading suggests this is to do with Teredo tunneling (IPV6 translation ...
1
vote
0answers
198 views
No authentication, AES encrypted JSON over UDP
I was recently assigned the task of testing a new hardware device which communicates with a JSON API over UDP.
For some reason or another, it was decided that AES-CBC-128 should be used to encrypt ...
0
votes
2answers
97 views
Find DNS Server of an IP over Internet [closed]
I know that many clients in the same network has a same DNS (Most of time but it can be changed.)
But is there anyway to understand what DNS Server that an specific IP (Over Internet) uses through ...
4
votes
2answers
815 views
Minimum required processes with open ports on AWS?
I recently started an AWS box to be used for a public web site and it seems to have the following ports open... I was long ago convinced that it's a good idea to minimize the attack surface on any box ...
1
vote
1answer
231 views
How does DTLS use a CBC cipher if the application data is not reliable over UDP?
From what I understand, when using DTLS, the TLS handshake is made reliable, but the transport of application data is not.
I'm looking at a PCAP from the DTLS section of the Wireshark site. The ...
1
vote
1answer
608 views
UDP replay “attack”
Suppose that there is a client-server application using UDP and you have full control over client. The task is to automate few known actions on the client and make them very fast.(Possibly bypass ...
1
vote
1answer
135 views
Following strategy using DDoS mitigation service - UDP bandwith exhaustion attack from spoofed IPs
I need to defend against receiving a massive spam of UDP packets from random spoofed IP addresses. I would make it this way:
In my protocol, every UDP packet contains username and password.
Firewall(...
5
votes
2answers
811 views
How to deal with UDP bandwidth exhaustion DDoS attacks?
I am building a service, which will use UDP. It will run on Amazon AWS - in the firewall they provide, I can block everything except that one UDP port my service will run.
The only thing I'm ...
4
votes
2answers
539 views
Do I have a IP leak if I use Tor and Skype/UDP?
I configure my OS so that it sends all traffic over the Tor (assume that, I configure Tor like proxy).
I use Tor (which does not support UDP) and Skype (which uses UDP).
My questions are:
Does that ...
1
vote
0answers
292 views
Linux service on UDP ports under MITM or fuzzing attack
I am rather new to this forum but I will try my best to explain my situation.
I run a game server for an outdated game called Project Reality. The community is rather small and the remaining servers ...
0
votes
2answers
691 views
IP leakage on Skype through VPN
Does anyone know how the traffic behaves if you configure a VPN natively through SSTP (WIN or MAC)?
Because most applications use the TCP, but Skype uses UDP.
I try to formulate more specific ...
2
votes
3answers
2k views
Why does our network firewall drop netbios-ns packets?
In our local domain environment, we use Sophos UTM to protect our network.
When I check the firewall logs, I can see that a huge number of packets dropped by the firewall are netbios-ns (UDP 137) ...
3
votes
3answers
7k views
Is QUIC (Quick UDP Internet Connections) safe to allow through firewall?
Our firewall currently blocks QUIC (UDP 443) traffic which seems to be enabled by default in Google Chrome. Is it safe to allow QUIC or should I wait until it is implemented in all the major browsers?
...
1
vote
0answers
727 views
UDP flood from my own IP
A few moments ago I was trying to open Youtube when the browser (Chrome) notified me that I have no internet connection. All of my cable connections were OK. I disconnected the cable from my computer ...
1
vote
1answer
2k views
How is UDP hijacking even possible?
My doubt is this: UDP has no sequence numbers, so what indeed is the concept behind UDP session hijacking?
2
votes
1answer
427 views
Can data coming into my UDP server be sniffed?
I have made a small tracking device. I am trying to reduce the data overhead as much as possible to make the device very cheap to run. We are working on the basis that 1MB = £0.01 (the data price at ...
