UDP Protocols

UDP: User Datagram Protocol

v      Why need UDP (or TCP)

Ø      On a single host, there might be many application programs

Ø      IP only identifies host, not application programs running on host

Ø      We need another thing to distinguish one application from another, so when the TCP/IP software receives a packet, it knows which program to send to.

Ø      TCP/IP uses protocol port number to distinguish programs. Application programs bind themselves to port numbers.

Ø      Both TCP and UDP have port numbers. They are different.

v      UDP

Ø      Transport-layer protocol

Ø      Connectionless service

Ø      Same best-effort semantics as IP

t         Messages can be delayed, lost, or duplicated

t         Messages can arrive out of order

Ø      Application accepts full responsibility for errors

Ø      UDP-based applications

t         DNS: Normal hosts query DNS servers using UDP in practice

t         Streaming video, Voice-over-IP

v      Encapsulation

v      UDP Message Format

v     UDP Multiplexing, Demultiplexing, and Ports

v     Reserved and Available UDP Port Numbers

Ø      Small numbers are reserved for specific applications

t         Called well-known ports

t         Same interpretation throughout the Internet

t         Used by server software

Ø      Large numbers are not reserved

t         Available to arbitrary application programs

t         Used by client software

Ø      Examples:

t         7 for Echo, 13 for daytime, 53 for DNS name server.

UDP Attacks

v     Fraggle

Ø      Broadcast UDP packet sent to the 'echo' service.

Ø      All computers reply (amplification).

Ø      Source IP was spoofed, victim is overwhelmed

Ø      Similar to the ICMP Smurf attack.

v     UDP Ping-Pong:

Ø      Some service or application issues a UDP reply no matter what is the input packet (e.g., error message).

Ø      Set the source and destination ports of a UDP to be one of the following ports

t         daytime (port 13)

t         time (port 37)

Ø      This causes a Ping-Pong effect between the source and the destination.

v     DoS Attacks

Ø      Key: Applications that reply with large packets to small requests, e.g., games

t         BattleField 1942

t         Quake 1 (CAN-1999-1066)

t         Unreal Tournament

Ø      Hosts can be attacked by using these applications as amplifiers, with forged source IP packets