nanog mailing list archives
Re: 20-30Gbps UDP 1720 traffic appearing to originate from CN in last 24 hours
From: John Weekes <jw () nuclearfallout net>
Date: Mon, 20 Jul 2015 16:24:45 -0700
Ca,
Folks, it may be time to take the next step and admit that UDP is too broken to support https://tools.ietf.org/html/draft-byrne-opsec-udp-advisory-00 Your comments have been requested
My comment would be that UDP is still widely used for game server traffic. This is unlikely to change in the near future because TCP (by default) is not well-suited for highly time-sensitive data, as even a small amount of packet loss causes significant delays.
In light of this, it is a bad idea for network operators to apply overall rate-limits to UDP traffic right now. Rate-limiting specific UDP /ports/ that are frequently seen in reflection attacks -- such as 19, 123, and 1900 -- is a more reasonable practice, however, and it is becoming more common/.
/UDP-based application protocols can be implemented correctly, such that they also have handshakes that limit their ability to be used for reflection attacks, and modern services (including modern game servers) do this.
TCP and UDP can both be spoofed and used for direct attacks; we see this all the time. UDP is preferred due to many applications protocols' susceptibility to amplification attacks, but spoofed TCP attacks are often a bit thornier to deal with from the standpoint of a host attempting to externally mitigate, because tracking the three-way handshake requires keeping state.
I spoke with Drew earlier and his attacks do not appear to be reflected, so this is orthogonal to his concern today. He is seeing directly-generated traffic, which could use any protocol.
-John
Current thread:
- RE: 20-30Gbps UDP 1720 traffic appearing to originate from CN in last 24 hours, (continued)
- RE: 20-30Gbps UDP 1720 traffic appearing to originate from CN in last 24 hours Justin M. Streiner (Jul 23)
- Re: 20-30Gbps UDP 1720 traffic appearing to originate from CN in last 24 hours Ca By (Jul 23)
- Re: 20-30Gbps UDP 1720 traffic appearing to originate from CN in last 24 hours Valdis . Kletnieks (Jul 23)
- Re: 20-30Gbps UDP 1720 traffic appearing to originate from CN in last 24 hours Mike Hammett (Jul 21)
- Re: 20-30Gbps UDP 1720 traffic appearing to originate from CN in last 24 hours Christopher Morrow (Jul 20)
- Re: 20-30Gbps UDP 1720 traffic appearing to originate from CN in last 24 hours ML (Jul 20)
- Re: 20-30Gbps UDP 1720 traffic appearing to originate from CN in last 24 hours Colin Johnston (Jul 20)
- Re: 20-30Gbps UDP 1720 traffic appearing to originate from CN in last 24 hours Valdis . Kletnieks (Jul 20)
- Re: 20-30Gbps UDP 1720 traffic appearing to originate from CN in last 24 hours James Milko (Jul 20)
- Re: 20-30Gbps UDP 1720 traffic appearing to originate from CN in last 24 hours John Weekes (Jul 20)
- Re: 20-30Gbps UDP 1720 traffic appearing to originate from CN in last 24 hours Jared Mauch (Jul 21)
- Re: 20-30Gbps UDP 1720 traffic appearing to originate from CN in last 24 hours Rafael Possamai (Jul 21)
- Re: 20-30Gbps UDP 1720 traffic appearing to originate from CN in last 24 hours Pavel Odintsov (Jul 21)
- Re: 20-30Gbps UDP 1720 traffic appearing to originate from CN in last 24 hours Rafael Possamai (Jul 21)
- Re: 20-30Gbps UDP 1720 traffic appearing to originate from CN in last 24 hours Pavel Odintsov (Jul 21)