How does the UDP flood attack really work?
The UDP flood attack depends on a particularity of the User Datagram Protocols (UDP) used in the attack. If a UDP packet is received on a server, the operating system checks the specified port for listening applications. If no app is found, the server must inform the sender.
What are the port numbers of a Unix server?
Common Well Known Port Numbers. The following are used by UNIX / Windows / Linux / BSD / OS X and all other server operating systems or network devices (see /etc/services file): 21: FTP Server. 22: SSH Server (remote login) 25: SMTP (mail server) 53: Domain Name System (Bind 9 server) 80: World Wide Web (HTTPD server)
How to increase the local port range in Linux?
You can increase local port range by typing the following command (Linux specific example): # echo 1024 65535 > /proc/sys/net/ipv4/ip_local_port_range. You can also increase or decrease socket timeout (Linux specific example): # echo 2000 > /proc/sys/net/ipv4/tcp_keepalive_time.
What to do if you face a port with an unknown service?
If you face a port with an unknown service you could try amap . Besides, p0f could also help you. These tools were designed exactly for info gathering purpose, so it can be your first try. Thanks for contributing an answer to Information Security Stack Exchange!
How does a server respond to a UDP request?
If a UDP packet is received on a server, the operating system checks the specified port for listening applications. If no app is found, the server must inform the sender. Since UDP is a connectionless protocol, the server uses the Internet Control Message Protocol (ICMP) to inform the sender that the packet could not be delivered.
Why is my router detecting constant ACK flood attacks?
I was asleep at this time, the “authentication success” bit worries me, my logs are full of ACK flood attacks and packet scans.