Communication over unsecured UDP

Many UDP communications are susceptible to amplification attacks. You might want to monitor communication over UDP on your network for the following situations: 

• Detecting UDP service amplification abuse

Prerequisites 

In order to execute this procedure in your environment, the following data, services, or apps are required:

• Netflow data

Example

You want to compare bytes sent to bytes received by your memcached server to determine whether the payload was amplified, which might indicate an attempt at a Denial of Service attack.

NOTE: To optimize the search shown below, you should specify an index and a time range. In addition, these sample searches use AWS VPC Flow logs and Splunk Stream. You can replace these sources with any other netflow data used in your organization.

Option 1

If you don't know the port number the external host is using, use this search. After you identify port numbers in use, you can use Option 2 to validate your findings.

1. Run the following search: 

sourcetype=aws:cloudwatchlogs:vpcflow (src_port=<memcached server port number> OR dest_port=<memcached server port number>)
|head 4
|table  _time duration account_id region interface_id src src_port dest dest_port bytes protocol packets vpcflow_action

Search explanation

The table provides an explanation of what each part of this search achieves. You can adjust this query based on the specifics of your environment.

Option 2

If you already know what port number the external host uses, use this search. 

1. Run the following search:

sourcetype=stream:udp (src_port=<client port number> OR src_port=<another client port number> OR src_port=<memcached server port number>)
|head 2
|eval short_src_content=substr(src_content,1,75)
|eval short_dest_content=substr(dest_content,1,75)
|table _time bytes_in bytes_out src src_port dest dest_port short_src_content short_dest_content

Search explanation

The table provides an explanation of what each part of this search achieves. You can adjust this query based on the specifics of your environment.

Result

Compare the bytes sent (bytes_out) to the bytes received (bytes_in) to see whether the payload has been amplified. For example, if 50 bytes were sent, but 51327 bytes were received, there is an amplification factor of almost 1027. Note that the byte values will vary slightly between the two search options provided in this guide due to IP overhead, such as packet options. 

Save this search to continue to monitor for packet size disparities. You might also want to monitor packet count disparities.