UDP flood attack detected

[ckchan]

Hello there,
My firewall monitoring tool keeps receiving "UDP flood attack detected" from one of our servers. Please advise what should i do

Thank you

[A. Clay Stephenson]

Your question doesn't make it clear if your server is the source of these packets or is the victim. In any event, the firewall should be able to identify the port number(s), the IP address(es), and the MAC address(es) of the sending host(s). The first few hex digits of the MAC address can help you identify the type of equipment if the IP addresses are unknown.

This sounds like you have some infected PC's on your network but you simply haven't provided enough data yet.

[ckchan]

Thanks for your response
The server is the source of the packet. How do i know the root cause?

[A. Clay Stephenson]

The answer is the same. The firewall should have logged the offending port number. You then need to find what process is using that port.

[ckchan]

Thank you