Questions tagged [udp]

UDP (User Datagram Protocol) is a simple connectionless transmission model formally defined in RFC 768.

Filter by
Sorted by
Tagged with
0 votes
0 answers
44 views

Hardened BitTorrent? DoS vulnerabilities?

Is there much information about hardening libtorrent usage, or perhaps other bittorrent flavors? I'm curious about denial-of-service attacks in particular. I could narrow down the bittorrent protocol ...
Jeff Burdges's user avatar
0 votes
1 answer
66 views

Can Hacker break the integrity of the data in UDP protocol?

Comparing the checksum received in the UDP segment with the checksum calculated in the data helps UDP determine the integrity of the data. Is there a case where the Hacker changes both the ...
JackieChain's user avatar
1 vote
1 answer
105 views

Next movement in IoT pentest when you have restricted information

I am a newbie cyber security engineer working on IoT. Today, a task is given to me. The task was making pentest to a cooker. Because of the privacy, I cannot share the brand of the cooker. The cooker ...
Not a Salmon Fish's user avatar
0 votes
0 answers
408 views

UDP Port Scan Attack from a previously used IP address

Yesterday my internet connection is interrupted and I checked the logs. In logs, I saw 2 UDP Port Scan Attack happened a week ago. After a little bit of research, I convinced myself that it is common ...
mzt's user avatar
  • 1
0 votes
0 answers
455 views

Symantec Endpoint Protection "Traffic has been blocked from this application: (svchost.exe)"

I'm currently getting this notification from SEP around twice a month saying "Traffic has been blocked from this application: (svchost.exe)" Logs: 1/3/2023 12:32 Blocked Major Incoming UDP .....
Theirry's user avatar
0 votes
0 answers
150 views

Can I use pcres in Suricata for UDP traffic?

I have a pattern that goes like this: Starts with |00|, is followed by a variable number of ASCII characters in uppercase that can have at most length 22, followed by 12 |00| bytes, followed by 6 ...
CBot's user avatar
  • 33
1 vote
1 answer
60 views

How to encrypt peer data exchange?

The situation currently is as follows: All our devices in the same network broadcast their state (alongside with unique IDs) over the network. They also listen in for broadcasts of others. Everything ...
SF.'s user avatar
  • 223
2 votes
1 answer
652 views

How SSL Protects against Replay Attacks?

Reading: https://mulloverthing.com/how-does-ssl-protect-against-replay-attack/ it says: The SSL/TLS channel itself is protected against replay attacks using the MAC (Message Authentication Code), ...
dan's user avatar
  • 19
1 vote
1 answer
402 views

Can my ISP or government listen to my Skype calls?

Is the call encrypted with something like HTTPS to prevent a corrupt government (or ISP) from messing with the DNS routing, sniffing, snooping etc? Can my ISP or government listen to my Skype calls? I'...
user274772's user avatar
3 votes
1 answer
2k views

ARP spoofing on TCP and UDP

Statement (In Interview): ARP spoofing attacks are more effective for UDP packets rather than TCP packets since TCP establishes reliable communication channels. I have opposed the statement saying ...
Prithvi Raj's user avatar
0 votes
0 answers
293 views

Loopback source IP Spoofing

Assuming I have a service running with elevated privileges on a host, and another service is listening on a UDP port with access for everyone (0.0.0.0) is it possible to craft a spoofed UDP datagram ...
GrowingBrick's user avatar
0 votes
1 answer
146 views

Why do DDoS attacks spoof DNS source IPs?

Recently, a lot of my friends have been talking about botnets. They said they've created their own.‌‌ Obviously, I ​​know this is all illegal so I try not to take part in any of it. But I've been ...
Hackermon's user avatar
1 vote
1 answer
123 views

Outgoing messages while under massive denial-of-service attack

As I understand it, there is no internet protocol that provides true broadcast like in say a card game or a partially synchronous network assumption. How close can internet protocols come though? We'...
Jeff Burdges's user avatar
1 vote
0 answers
124 views

How Should Multiple Checksums Be Performed On the Same Data? [closed]

I am using CRC32 to verify the integrity of received UDP packets. Along with the generator polynomial, the sender will also specify how many checksums to perform on the sent data, as well as what ...
Justin Marinelli's user avatar
0 votes
1 answer
183 views

Would adding `--data-string` to a UDP scan change the results?

I'm doing UDP scans on some internal servers and want to add a custom token (randomly generated string) to packets as much as possible in order to later filter out my scans from real non-testing ...
ChocolateOverflow's user avatar
-2 votes
1 answer
888 views

HTTP/3 No more TLS or TCP [closed]

I was reading documentation about HTTP/3, and in the article, they sed that they are no longer TLS or TCP. So it's mean that a web site with no SSL 80 will be changed to what port and 443 will be ...
User3298137412's user avatar
0 votes
3 answers
2k views

Is there any alternative to nmap for UDP?

I know UDP Scan is very slow and there are a lots of parameters for nmap like, --max-retries etc. But i want to speedly udp port scan. I tried a lots of programs but not speedly. Any alternative nmap ...
mariam's user avatar
  • 11
0 votes
1 answer
71 views

how do you find all upd connections a remote server has? [closed]

Given an IP address of a server connecting to unknown clients via UDP, is it possible to find the IP address of all connected sessions on that server? I do not have access to the server, I would like ...
user299709's user avatar
0 votes
0 answers
283 views

Will anyone figure out who I am if I am downloading torrent while logged in facebook in my browser?

I have protonvpn. I am downloading torrents. I don't want anyone to know that I am downloading torrents. I am also logged in to Facebook in my browser. So Facebook knows my VPN IP. And my ISP knows ...
odbhut.shei.chhele's user avatar
1 vote
2 answers
357 views

What is the most powerful type of DDOS/DOS attack? [closed]

What I mean is what protocol are best to DOS something like TCP, UDP, HTTP?
user13254086's user avatar
2 votes
1 answer
713 views

Server is sending large amounts of encrypted UDP traffic

The hosting company of a client has shut down their Windows server twice in the past week because the server seems to be sending out massive amounts of outbound encrypted UDP DNS traffic. I have now ...
saxum's user avatar
  • 31
0 votes
1 answer
630 views

Why is SNMP vulnerable to IP Spoofing?

I read on Wikipedia's Article on SNMP SNMPv1 and v2 are vulnerable to IP spoofing attacks, whether it runs over TCP or UDP, and is a subject to bypassing device access lists that might have ...
PhantomR's user avatar
  • 101
0 votes
2 answers
398 views

Why do firewalls focus on tcp and udp?

From what I can see, most firewalls seem to focus on tcp and udp. Why is that? Is it impossible or at least very unlikely for malware to use other protocols/custom protocols?
DevShark's user avatar
  • 343
0 votes
2 answers
2k views

Is UDP used for applications that require less security?

We often hear TLS over TCP socket and very famliar with its use case e.g. HTTPS. While I am learning Linux socket progamming, I read a An Introduction to OpenSSL Programming, Part I of II tutorial . (...
Rick's user avatar
  • 1,027
1 vote
1 answer
190 views

UDP amplification: length(response_packet) < length(request_packet)

I was researching the GitHub DDoS attack of 2018, in which memcached UDP amplification was used. I noticed that a GitHub blog post referenced a CloudFlare post which described memcached-based UDP ...
CharlieBucket's user avatar
3 votes
1 answer
16k views

What is this service? [closed]

Fairly new to infosec and am going through a course on nmap. While scanning I found this and it looked interesting and was wondering if you all had any information on this? This is the port,state and ...
shadowjax's user avatar
2 votes
2 answers
964 views

Do I have to block UDP ports when I launch my own server with a public IP?

I am trying to give better security to my Raspberry sever. When I installed UFW, I allowed just port 80/tcp and my own high port for SSH communication, and by default are all others ports "deny". ...
S3jp4kCZE's user avatar
1 vote
1 answer
69 views

Why do processes on servers have socket types associated to the port number? [closed]

Why do some servers have TCP/UDP alongside the port they're listening to. To my understanding TCP and UDP are socket layers, they're methods of determining how the traffic is being sent over the ...
J.Doe's user avatar
  • 11
-2 votes
1 answer
2k views

What is the difference between DNS flood attack and UDP flood attack?

As title says, what is the difference between DNS flood attack and UDP flood attack? Plus, do they only exhaust the network bandwidth or do they also exhaust the server-side assets such as CPU, ...
eliwax's user avatar
  • 1
2 votes
1 answer
2k views

Encrypting UDP? (not using DTLS)

We are exploring options on encrypting messages to 3rd party devices which operate on UDP messages. Since each vendor will need to implement the encryption-decryption process as well, we would like ...
emaayan's user avatar
  • 21
0 votes
2 answers
555 views

How does DTLS replace the transport encryption of TLS? [duplicate]

I've been reading the RFC for DTLS over UDP, but can't seem to understand, how the transport encryption aspect of TLS was handled. It reads to me, like they just didn't bother, since there can be ...
Minix's user avatar
  • 109
1 vote
1 answer
90 views

is -nU an option with nmap?

My coworkers seem to have -nU (no udp) as an option for their nmap scripts but I've never seen this in use and when I try to use this option with nmap, it does not work. I thought no udp was enabled ...
UCProgrammer's user avatar
2 votes
2 answers
648 views

One way protocol with encryption without tcp

I am trying to brainstorm how I might either: 1) create a protocol (although against this option) 2) use an existing protocol That does the following: 1) allows 1 way communication from 1 node to ...
Jshee's user avatar
  • 121
0 votes
1 answer
2k views

Vulnerabilities of DNS when utilized on a TCP port

There was some specific cyber security challenge (Cyber Cube 2018, GE). In one of the tasks, objective was to gain the access to some specific file that server included. After successfully solving ...
ShellRox's user avatar
  • 161
1 vote
0 answers
137 views

Machine reaching out to Microsoft IP address using NBTstat command

I have limited logs for this event but the IPS says its a NBTstat query outbound over UDP port 137 to a Microsoft owned IP address. Should UDP 137 ever reach out externally? This is about all the ...
Kajunga's user avatar
  • 11
2 votes
1 answer
605 views

Security implications of setting the broadcast flag on a UDP socket

Are there any negative security effects of setting the SO_BROADCAST option in a C UDP socket? I'm writing a C program and if I just set the broadcast option to 1 then all IP addresses work as intended,...
user's user avatar
  • 616
2 votes
3 answers
2k views

UDP vs ICMP flood

How can we measure the efficiency of the flood technique? Will it be by the number of bots required for flooding the link? In case of UDP and ICMP, which one would be more efficient and why?
hatellla's user avatar
  • 121
1 vote
2 answers
2k views

Why is spoofing allowed in reputed VPS services?

I just learned about IP spoofing and so I set up VMs and sent spoofed UDP packets (8.8.8.8, Facebook's IP, Twitter's IP) to myself (home PC and mobile) from well-reputed VPS providers like AWS, ...
Al-Alamin's user avatar
  • 121
3 votes
2 answers
2k views

How many UDP packets is too many?

My Company recently got hit by a spam email with a link that executed an .exe file. Apparently our Antivirus stopped it from executing (Symantec enterprise). I'm no security expert, but I am a ...
darkmoon's user avatar
4 votes
2 answers
967 views

UDP flood 300 Kbps + SYN probes / other attacks. Flood or DDoS at low rate?

So for over 2 weeks, Im receiving what appears a combination of attacks non-stop 24/7. First this UDP flood at a strangely small rate of 280 Kbps / 110 pps (360 bytes length) 02:29:41.978484 IP (tos ...
Jonas's user avatar
  • 81
-3 votes
2 answers
2k views

Insecure/Obsolete TCP/UDP Ports? [closed]

I used CurrPorts to monitor TCP/IP network connections. This image shows when I don't connect to the Internet but I don't know why Avast Antivirus established this port. Is it insecure? This image ...
Rei's user avatar
  • 34
2 votes
1 answer
668 views

How to handle UDP abnormally disconnection in DTLS?

DTLS-UDP is used between client and server. If the client ends abnormally,how does the server know that the client is gone? i have read rfc6347 and find nothing about that. thanks in advance.
43h's user avatar
  • 25
0 votes
1 answer
914 views

If TCP is more "secure" than UDP, how would a practical UDP "attack" look, for example during the initiation of a MS RDP connection?

In accordance to the recent question Why is TCP more secure than UDP?. How would an "attack" look when it comes to the practical aspect? A great example would be the use of TCP or UDP for Microsoft ...
Bob Ortiz's user avatar
  • 6,661
62 votes
11 answers
56k views

Why is TCP more secure than UDP?

While reading MS SDL (Microsoft Security Development Lifecycle) presentations I found a recommendation to replace UDP with TCP in applications because TCP is more secure than UDP. But both of them are ...
sluge's user avatar
  • 1,085
0 votes
1 answer
510 views

How to block an application with iptable which use random port

Scenario: My goal was to allow TeamViewer to connect to my home workstation from my laptop only. So I have tried to bind my laptop's MAC with an IPtables rule as following, [arif@arif:~]$ sudo ...
arif's user avatar
  • 1,146
1 vote
0 answers
115 views

Spoofing an IP/MAC address to avoid ICMP Destination Unreachable being sent back [duplicate]

As far as I understand UDP flooding the idea is to send UDP packets across all ports from e.g. Alice to Bob, and get Bob's machine to check who listens to certain ports and generate many ICMP ...
chao's user avatar
  • 111
2 votes
2 answers
3k views

Using IPsec through NAT

I have read that it is recommended to encapsulate IPsec packets into UDP (port 4500) packets in order to circumvent NAT. Could anyone please provide a detailed explanation of the reasons behind this ...
sasuke_X220's user avatar
2 votes
2 answers
4k views

Authenticate a user thru a UDP socket

so let's say I had a basic socket, doesn't give you any information about the user other than the IP address, what would be my options If I wanted to authenticate a user in the most optimal way ...
Whiteclaws's user avatar
3 votes
2 answers
15k views

Windows firewall settings to receive UDP and pings

I use a windows 10 to receive UDP packets or pings from another computer which runs Win/Mac/Linux. I default, I turn off the firewall to receive pings or packets. I prefer not to turn off the ...
Jack's user avatar
  • 31
3 votes
1 answer
650 views

Is it possible to scan the top X UDP ports and the top Y (X!=Y) TCP ports in Nmap using a single command?

Given X!=Y, is there any way to scan the top (--top-ports) X TCP ports and the top Y UDP ports using a simple Nmap command? The --top-ports parameter affects both the TCP and UDP scans (e.g., when -...
Gari BN's user avatar
  • 485