UDP and ICMP Flood Protection | SonicWall (2024)

08/17/2021 293 People found this article helpful 133,579 Views

Description

UDP and ICMP Flood attacks are a type of denial-of-service (DoS) attack. They are initiated by sending a large number of UDP or ICMP packets to a remote host. As a result, the victimized system's resources will be consumed with handling the attacking packets, which eventually causes the system to be unreachable by other clients.

Resolution

For UDP Flood Protection Option(GUI)

1. ClickMANAGEand then navigate toFirewall Settings | Flood Protection.
2. On the Top bar , clickUDP.
3. UnderUDP Flood Protection, enable checkboxEnable UDP Flood Protection.
4. The following settings configureUDP Flood Protection.
   • UDP Flood Attack Threshold (UDP Packets / Sec) The rate of UDP packets per second sent to a host, range or subnet that triggers UDP Flood Protection. The Threshold must be set carefully as too small a threshold may affect unintended traffic and too large a threshold may not effectively protect from an attack. The default value is1000.
   • UDP Flood Attack Blocking Time (Sec) After the appliance detects the rate of UDP packets exceeding the attack threshold for this duration of time, UDP Flood protection is activated, and the appliance will begin dropping subsequent UDP packets.
   • UDP Flood Attack Protected Destination List The destination address object or address group that will be protected from UDP Flood Attack. If the destination target is random, set this field toAny.
5. ClickAccept.
   
   The following log messages will be generated when SonicWall detects a UDP Flood Attack. The logs can be filtered byCategoryFirewall Settings andGroupFlood protection.
   

UDP Flood Protection can also be configured from the CLI.

1. Login to the CLI.
2. EnterConfigurationmode.
3. Enter the following commands to enable UDP Flood protection.

• default-connection-timeout #Set default UDP connection timeout in minutes.
• flood-attack-threshold #Set UDP Flood Attack Threshold (UDP Packets / Sec).
• flood-block-timeout #Set UDP Flood Attack Blocking Time (Sec).
• flood-protected-dest-list #Set UDP flood attack protected destination list.
• flood-protection #Enable UDP flood protection.

For ICMP Flood Protection Option

1. ClickMANAGEand then navigate toFirewall Settings | Flood Protection.
2. On the Top bar , clickICMP.
3. UnderICMP Flood Protection, enable checkboxEnable ICMP Flood Protection.
4. The following settings configureICMP Flood protection.
   • ICMP Flood Attack Threshold (ICMP Packets / Sec) The rate of ICMP packets per second sent to a host, range or subnet that triggers ICMP Flood protection. The Threshold must be set carefully as too small a threshold may affect unintented traffic and too large a threshold may not effectively protect from an attack. The default value is200.
   • ICMP Flood Attack Blocking Time (Sec)After the appliance detects the rate of ICMP packets exceeding the attack threshold for this duration of time, ICMP Flood protection is activated, and the appliance will begin dropping subsequent ICMP packets.
   • ICMP Flood Attack Protected Destination ListThe destination address object or address group that will be protected from ICMP Flood attack.
5. ClickAccept.
   
   The following log messages will be generated when SonicWall detects a ICMP Flood Attack. The logs can be filtered byCategoryFirewall Settings andGroupFlood protection.

• Connections Opened Incremented when a UDP connection initiator sends aSYN, or a UDP connection responder receives aSYN.
• ConnectionsClosedIncremented when a UDP connection is closed when both the initiator and the responder have sent aFINand received anACK.
• Total UDP Packets Incremented with every processedUDPpacket.
• Validated Packets Passed Incremented under the following conditions:
  • When a UDP packet passeschecksumvalidation (while UDP checksum validation is enabled).
  • When a valid SYN packet is encountered (while SYN Flood protection is enabled).
  • When a SYN Cookie is successfully validated on a packet with theACK flagset (whileSYN Flood protectionis enabled).
• Malformed Packets Dropped - Incremented under the following conditions:
  • When UDPchecksumfails validation (while UDP checksum validation is enabled).
  • When the UDP SACK Permitted (Selective Acknowledgment, seeRFC1072) option is encountered, but the calculated option length is incorrect.
  • When the UDPMSS(Maximum Segment Size) option is encountered, but the calculated option length is incorrect.
  • When the UDP SACK option data is calculated to be either less than the minimum of 6 bytes, or modulo incongruent to the block size of4 bytes.
  • When the UDP option length is determined to be invalid.
  • When the UDP header length is calculated to be less than the minimum of20 bytes.
  • When the UDP header length is calculated to be greater than the packet's data length.
• UDP Floods In Progress The number of individual forwarding devices that are currently exceeding the UDP Flood Attack Threshold.
• Total UDP Floods Detected The total number of events in which a forwarding device has exceeded the UDP Flood Attack Threshold
• Total UDP Flood Packets Rejected The total number of packets dropped because of UDP Flood Attack detection.

ICMP Traffic Statistics

• The ICMP traffic statistics table provides the same categories of information as the UDP traffic statistics above.

Resolution for SonicOS 6.2 and Below

The below resolution is for customers using SonicOS 6.2 and earlier firmware. For firewalls that are generation 6 and newer we suggest to upgrade to the latest general release of SonicOS 6.5 firmware.

Configuring UDP Flood Protection(GUI)

1. Login to the SonicWall management GUI.
2. Navigate toFirewall Settings | Flood Protection page.
3. Under UDP Flood Protection, enable checkbox Enable UDP Flood Protection.
4. The following settings configure UDP Flood Protection.
   • UDP Flood Attack Threshold (UDP Packets / Sec): The rate of UDP packets per second sent to a host, range or subnet that triggers UDP Flood Protection. The Threshold must be set carefully as too small a threshold may affect unintended traffic and too large a threshold may not effectively protect from an attack. The default value is 1000.
   • UDP Flood Attack Blocking Time (Sec): After the appliance detects the rate of UDP packets exceeding the attack threshold for this duration of time, UDP Flood protection is activated, and the appliance will begin dropping subsequent UDP packets.
   • UDP Flood Attack Protected Destination List: The destination address object or address group that will be protected from UDP Flood attack. If the destination target is random, set this field to Any.
5. ClickAccept.

   The following log messages will be generated when SonicWall detects a UDP Flood attack. The logs can be filtered by Category Firewall Settings and Group Flood Protection.

Configuring UDP Flood Protection(CLI)

1. Login to the CLI.
2. Enter Configuration mode.
3. Enter the following commands to enable UDP Flood protection.

• default-connection-timeout #Set default UDP connection timeout in minutes.
• flood-attack-threshold #Set UDP Flood Attack Threshold (UDP Packets / Sec).
• flood-block-timeout #Set UDP Flood Attack Blocking Time (Sec).
• flood-protected-dest-list #Set UDP flood attack protected destination list.
• flood-protection #Enable UDP flood protection.

Configuring ICMP Flood Protection

1. Login to the SonicWall management GUI.
2. Navigate toFirewall Settings | Flood Protection page.
3. Under ICMP Flood Protection, enable checkbox Enable ICMP Flood Protection.
4. The following settings configure ICMP Flood Protection.
   • ICMP Flood Attack Threshold (ICMP Packets / Sec) The rate of ICMP packets per second sent to a host, range or subnet that triggers ICMP Flood protection. The Threshold must be set carefully as too small a threshold may affect unintented traffic and too large a threshold may not effectively protect from an attack. The default value is 200.
   • ICMP Flood Attack Blocking Time (Sec) After the appliance detects the rate of ICMP packets exceeding the attack threshold for this duration of time, ICMP Flood protection is activated, and the appliance will begin dropping subsequent ICMP packets.
   • ICMP Flood Attack Protected Destination List The destination address object or address group that will be protected from ICMP Flood attack.
5. ClickAccept at the top.
   The following log messages will be generated when SonicWall detects a ICMP Flood Attack. The logs can be filtered by Category Firewall Settings and Group Flood protection.
   

• Connections Opened Incremented when a UDP connection initiator sends a SYN, or a UDP connection responder receives a SYN.
• Connections Closed Incremented when a UDP connection is closed when both the initiator and the responder have sent a FIN and received an ACK.
• Total UDP Packets Incremented with every processed UDP packet.
• Validated Packets Passed Incremented under the following conditions.
  • When a UDP packet passes checksum validation (while UDP checksum validation is enabled).
  • When a valid SYN packet is encountered (while SYN Flood protection is enabled).
  • When a SYN Cookie is successfully validated on a packet with the ACK flag set (while SYN Flood protection is enabled).
• Malformed Packets Dropped - Incremented under the following conditions:
  • When UDP checksum fails validation (while UDP checksum validation is enabled).
  • When the UDP SACKpermitted (Selective Acknowledgment, see RFC1072) option is encountered, but the calculated option length is incorrect.
  • When the UDP MSS (Maximum Segment Size) option is encountered, but the calculated option length is incorrect.
  • When the UDP SACK option data is calculated to be either less than the minimum of 6 bytes, or modulo incongruent to the block size of 4 bytes.
  • When the UDP option length is determined to be invalid.
  • When the UDP header length is calculated to be less than the minimum of 20 bytes.
  • When the UDP header length is calculated to be greater than the packet's data length.
• UDP Floods In Progress The number of individual forwarding devices that are currently exceeding the UDP Flood attack Threshold.
• Total UDP Floods Detected The total number of events in which a forwarding device has exceeded the UDP Flood attack Threshold
• Total UDP Flood Packets Rejected The total number of packets dropped because of UDP Flood attack detection.

ICMP Traffic Statistics

• The ICMP traffic statistics table provides the same categories of information as the UDP traffic statistics above.

Related Articles

• How can I enable Enhanced Audit Logging Support?
• How do I configure 2FA for SSL VPN with TOTP?
• No 2FA Prompt for accessing Management Console using GVC.

Categories

• Firewalls > NSa Series > Networking
• Firewalls > NSv Series > Networking
• Firewalls > TZ Series > Networking

Was This Article Helpful?

YESNO