{"id":52438,"date":"2019-11-08T00:00:00","date_gmt":"2019-11-07T21:00:00","guid":{"rendered":"https:\/\/prohoster.info\/blog\/blog_prohoster\/udp-flood-ot-google-ili-kak-ne-lishit-vseh-youtube"},"modified":"2020-02-18T14:00:09","modified_gmt":"2020-02-18T11:00:09","slug":"udp-flood-ot-google-ili-kak-ne-lishit-vseh-youtube","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/administrirovanie\/udp-flood-ot-google-ili-kak-ne-lishit-vseh-youtube","title":{"rendered":"UDP Flood from Google or how not to take down everyone on YouTube","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

One beautiful spring evening, when I didn\u2019t want to go home and an insatiable desire to live and learn burned in me like a hot iron, the idea arose to tinker with a tempting feature on the firewall called «IP DOS policy<\/b>«.
\nAfter some preliminary affection and familiarization with the manual, I set it up in the mode Pass-and-Log<\/b>, to see what the output was and to assess the questionable usefulness of this setting.
\nA couple of days later (to let the statistics accumulate, of course, not because I forgot), I looked at the logs and, dancing on the spot, I clapped my hands \u2014 there were records piled up to the brim. It seemed simple enough \u2014 just enable the policy to block all those flooding, scanning, establishing half-open<\/b> sessions with a one-hour ban and go to sleep peacefully, assured that the border is secure. But having turned 34, I overcame youthful maximalism, and somewhere in the back of my mind, a tiny voice spoke up: \"Let's lift our eyelids and see whose addresses our beloved firewall has recognized as notorious spammers? Just for fun.\"
\n<\/a><\/noindex>
\nWe begin to analyze the collected data from the list of anomalies. I run the addresses through a simple script Powershell<\/b> and my eyes catch familiar letters google<\/b>. <\/p>\n

\"UDP
\n
\nRubbing my eyes, I blink for five minutes to make sure I\u2019m not imagining things \u2014 indeed, on the list of those whom the firewall considered to be a notorious spammer, the type of attack is udp flood<\/b>, addresses belonging to the good corporation. <\/p>\n

\"UDP
\n\"UDP
\n\"UDP
\n\"UDP
\n
\nScratching my head while simultaneously setting up packet capture on the external interface for further analysis. Thoughts swirl in my mind: \u201cHow is it that something infected is within Google\u2019s scope? And I discovered this? This means rewards, honors, a red carpet, and my own casino with blackjack and, well, you get it\u2026<\/p>\n

I analyze the received file Wireshark<\/b>-th.
\nYes, indeed, packets are being blasted from an address within the scope Google <\/b>of UDP packets from port 443 to a random port on my device.
\nBut wait a minute\u2026 Here the protocol changes from UDP<\/b> to GQUIC<\/b>.
\nSemyon Semyonovich\u2026<\/p>\n

\"UDP
\n
\nI immediately recall the report from HighLoad <\/b>by Alexander Tobol<\/u> <<UDP<\/b> against TCP<\/b> or the future of the network stack»link<\/a><\/noindex>).
\nOn one hand, there's a slight disappointment \u2014 no laurels, no honors for you, good sir. On the other hand, the problem is clear; it remains to understand where and how much to dig.
\nA few minutes talking with the Good Corporation \u2014 and everything falls into place. In an attempt to improve content delivery speed, the company Google <\/b>announced the protocol back in 2012 QUIC<\/b>, which allows eliminating most of TCP's drawbacks (yes, yes, yes, in these articles \u2014 Rrraz<\/a><\/noindex><\/b> and Two<\/a><\/noindex><\/b> there is talk of a completely revolutionary approach, but, let's be honest, we just want pictures of kittens to load faster, not all these revolutions of consciousness and progress). Subsequent research showed that many organizations are now transitioning to this type of content delivery.
\nThe problem in my case, and I think in others as well, turned out to be that too many packets were being sent, and the firewall perceived them as flooding.
\nThere were only a few solutions:
\n1. Add to the exceptions list for DoS Policy<\/b> on the firewall scope of addresses Google<\/b>. Just thinking about the range of possible addresses made my eye twitch \u2014 the idea was shelved as absurd.
\n2. Increase the trigger threshold for udp flood policy<\/b> \u2014 also not advisable, what if someone really malicious slips through.
\n3. Prohibit outbound requests from the internal network on UDP <\/b>to 443 <\/b>port outward.
\nAfter reading additional information on implementation and integration, the last option was accepted as the course of action. The thing is that the one beloved everywhere and mercilessly (I can't understand why, it's better to have the brazen red QUIC <\/b>downward API support (simultaneously with this in Google Chrome<\/b> -skinned face receive punishment for the consumed gigabytes of RAM), Firefox<\/b>initially tries to establish a connection using its well-earned Google Chrome<\/b> , but if the miracle doesn't happen, it resorts to tried and tested methods like QUIC<\/b>, albeit with great shame. TLS<\/b>We create an entry for the service on the firewall <\/p>\n

We set up a new rule and place it higher up in the chain. QUIC<\/b>:<\/p>\n

\"UDP
\n
\nAfter enabling the rule in the anomaly list, everything is quiet and smooth, except for truly malicious violators.<\/p>\n

\"UDP
\n
\nThank you all for your attention.<\/p>\n

\"UDP
\n
\nResources used:<\/p>\n

Report by Alexander Tobol<\/b><\/u>
\n1.Description of the QUIC protocol by Infopulse<\/a><\/noindex>
\n2.KB from Fortinet<\/a><\/noindex>
\n3.Wikipedia<\/a><\/noindex>
\n4. One fine spring evening, when I didn't want to go home, and an insatiable desire to live and learn burned like a hot iron, the idea to tinker with a tempting feature on the firewall called emerged.<\/a><\/noindex>
\n
Source: habr.com<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u041e\u0434\u043d\u0438\u043c \u043f\u0440\u0435\u043a\u0440\u0430\u0441\u043d\u044b\u043c \u0432\u0435\u0441\u0435\u043d\u043d\u0438\u043c \u0432\u0435\u0447\u0435\u0440\u043e\u043c, \u043a\u043e\u0433\u0434\u0430 \u0438\u0434\u0442\u0438 \u0434\u043e\u043c\u043e\u0439 \u043d\u0435 \u0445\u043e\u0442\u0435\u043b\u043e\u0441\u044c, \u0430 \u043d\u0435\u0443\u0435\u043c\u043d\u043e\u0435 \u0436\u0435\u043b\u0430\u043d\u0438\u0435 \u0436\u0438\u0442\u044c \u0438 \u043f\u043e\u0437\u043d\u0430\u0432\u0430\u0442\u044c \u0441\u0432\u0435\u0440\u0431\u0438\u043b\u043e \u0438 \u0436\u0433\u043b\u043e \u0430\u043a\u0438 \u043a\u0430\u043b\u0435\u043d\u044b\u043c \u0436\u0435\u043b\u0435\u0437\u043e\u043c, \u0432\u043e\u0437\u043d\u0438\u043a\u043b\u0430 \u0438\u0434\u0435\u044f \u043f\u043e\u043a\u043e\u0432\u044b\u0440\u044f\u0442\u044c \u0437\u0430\u043c\u0430\u043d\u0447\u0438\u0432\u0443\u044e \u043f\u0440\u0438\u0431\u043b\u0443\u0434\u0443 \u0444\u0438\u0447\u0443 \u043d\u0430 \u0444\u0430\u0439\u0440\u0432\u043e\u043b\u0435 \u043f\u043e\u0434 \u043d\u0430\u0437\u0432\u0430\u043d\u0438\u0435\u043c «IP DOS policy«. \u041f\u043e\u0441\u043b\u0435 \u043f\u0440\u0435\u0434\u0432\u0430\u0440\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u0445 \u043b\u0430\u0441\u043e\u043a \u0438 \u043e\u0437\u043d\u0430\u043a\u043e\u043c\u043b\u0435\u043d\u0438\u044f \u0441 \u043c\u0430\u043d\u0443\u0430\u043b\u043e\u043c \u043d\u0430\u0441\u0442\u0440\u043e\u0438\u043b \u0432 \u0440\u0435\u0436\u0438\u043c\u0435 Pass-and-Log, \u0447\u0442\u043e\u0431\u044b \u043f\u043e\u0441\u043c\u043e\u0442\u0440\u0435\u0442\u044c \u0432\u043e\u043e\u0431\u0449\u0435 \u043d\u0430 \u0432\u044b\u0445\u043b\u043e\u043f \u0438 \u0441\u043e\u043c\u043d\u0438\u0442\u0435\u043b\u044c\u043d\u0443\u044e \u043f\u043e\u043b\u0435\u0437\u043d\u043e\u0441\u0442\u044c \u0434\u0430\u043d\u043d\u043e\u0439 \u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0438. […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-52438","post","type-post","status-publish","format-standard","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47UDP Flood from Google or how to avoid shutting down all YouTube | ProHoster","description":"\ud83e\udd47UDP Flood from Google or how not to deprive everyone of Youtube | ProHoster","canonical_url":"https:\/\/prohoster.info\/en\/blog\/administrirovanie\/udp-flood-ot-google-ili-kak-ne-lishit-vseh-youtube","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"en_US","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47UDP Flood \u043e\u0442 Google \u0438\u043b\u0438 \u043a\u0430\u043a \u043d\u0435 \u043b\u0438\u0448\u0438\u0442\u044c \u0432\u0441\u0435\u0445 Youtube | ProHoster","og:description":"\u041e\u0434\u043d\u0438\u043c \u043f\u0440\u0435\u043a\u0440\u0430\u0441\u043d\u044b\u043c \u0432\u0435\u0441\u0435\u043d\u043d\u0438\u043c \u0432\u0435\u0447\u0435\u0440\u043e\u043c, \u043a\u043e\u0433\u0434\u0430 \u0438\u0434\u0442\u0438 \u0434\u043e\u043c\u043e\u0439 \u043d\u0435 \u0445\u043e\u0442\u0435\u043b\u043e\u0441\u044c, \u0430 \u043d\u0435\u0443\u0435\u043c\u043d\u043e\u0435 \u0436\u0435\u043b\u0430\u043d\u0438\u0435 \u0436\u0438\u0442\u044c \u0438 \u043f\u043e\u0437\u043d\u0430\u0432\u0430\u0442\u044c \u0441\u0432\u0435\u0440\u0431\u0438\u043b\u043e \u0438 \u0436\u0433\u043b\u043e \u0430\u043a\u0438 \u043a\u0430\u043b\u0435\u043d\u044b\u043c \u0436\u0435\u043b\u0435\u0437\u043e\u043c, \u0432\u043e\u0437\u043d\u0438\u043a\u043b\u0430 \u0438\u0434\u0435\u044f \u043f\u043e\u043a\u043e\u0432\u044b\u0440\u044f\u0442\u044c \u0437\u0430\u043c\u0430\u043d\u0447\u0438\u0432\u0443\u044e \u043f\u0440\u0438\u0431\u043b\u0443\u0434\u0443 \u0444\u0438\u0447\u0443 \u043d\u0430 \u0444\u0430\u0439\u0440\u0432\u043e\u043b\u0435 \u043f\u043e\u0434 \u043d\u0430\u0437\u0432\u0430\u043d\u0438\u0435\u043c.","og:url":"https:\/\/prohoster.info\/en\/blog\/administrirovanie\/udp-flood-ot-google-ili-kak-ne-lishit-vseh-youtube","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-11-07T21:00:00+00:00","article:modified_time":"2020-02-18T11:00:09+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"52438","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-24 03:36:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 20:43:24","updated":"2026-01-24 03:36:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/posts\/52438","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/comments?post=52438"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/posts\/52438\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/media?parent=52438"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/categories?post=52438"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/tags?post=52438"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}