User Datagram Protocol (UDP)

introductiontonetworking intro_to_network_traffic_analysis packetsframes

User Datagram Protocol (UDP) is used for fast messaging, by applications that don't mind if a packet is lost/incorrect. It's

  • connection-less đŸĻ˜: no prior connection is established
  • stateless 🙉: no information about the session is kept

It's used when speed is more important than quality.

🐊ī¸ Port: N/A

đŸ—ēī¸ Used by: dhcp, dig, dns...

✍ī¸ UDP PDUs are called datagrams.

It's not trustworthy:

  • 🚮 No warranty that the message will be received
  • 🙅 No warranty that the message received is correct
  • đŸĨ No warranty that the message are received in the correct order

UDP Header

  • 2 bytes for the "source port"
  • 2 bytes for the "destination port"
  • 2 bytes for the "size of the message"
  • 2 bytes for the "checksum of the message"

TCP vulnerabilities

  • UDP Checksum Attack

👉 An attacker manipulates the checksum allowing tampered packets to by accepted. ➡ī¸ Use encryption (IPSec, a VPN...).

  • UDP Flood Attack

👉 An attacker send many UDP requests to slowdown or overwhelm the target. đŸ’Ĩ DoS ➡ī¸ Setup filtering, rate-limiting...