UDP

UDP, the User Datagram Protocol, is a transport layer protocol specified in RFC 768.

Unlike TCP, it is connectionless: it does not establish a session before sending data, and it does not guarantee that datagrams arrive, arrive intact, or arrive in the order they were sent.

That fire and forget design is what makes it fast and cheap, and it is the right choice where losing a packet matters less than waiting for it: DNS lookups, real time voice and video, telemetry, and a good part of modern web traffic through QUIC.

Why the design has security consequences

Because there is no handshake, no flow control and no retransmission, three things follow directly, and all three are exploited routinely.

Flooding. UDP flood attacks send large volumes of datagrams at a target, exhausting its resources and producing a denial of service. There is no connection to refuse, so the receiving system pays a cost simply for being sent traffic.

Source address spoofing. Nothing in UDP proves where a datagram came from. An attacker can forge the source address to hide, to get past controls written in terms of addresses, or to build a reflection attack: send a small request to a third party with the victim’s address as the source, and let the third party send a much larger answer to the victim. That is why open DNS, NTP and memcached services keep turning up in amplification incidents, and why egress filtering at the network edge matters to people other than the network that deploys it.

Port scanning behaves differently. Scanning UDP is slower and less conclusive than scanning TCP, because a closed port answers with an ICMP message that is often rate limited or dropped, while an open one may not answer at all. The practical consequence is that UDP services get scanned less thoroughly, by defenders as well as by attackers, and therefore get forgotten. A forgotten service on a permitted port is exactly the kind of thing an assessment is for.

UDP and the firewall

Stateful packet filtering was designed around the TCP connection: the firewall watches the handshake and knows what a legitimate reply looks like. UDP has no handshake, so a firewall approximates the same thing with a short lived pseudo state, which is a weaker guarantee and one worth understanding before writing rules that assume otherwise.

It also explains why DNS tunnelling works as often as it does. Outbound DNS is permitted almost everywhere, and it is UDP, so a channel built inside it looks like ordinary name resolution to anything that inspects only addresses and ports.

Where to read more

RFC 768, User Datagram Protocol: the original specification, three pages long, and worth reading precisely because of how little it promises.

Cisco, User Datagram Protocol: a description of how UDP works, what it is used for and the security considerations that come with it.