What is a UDP Flood; why does TR7 apply a separate flood limit to DNS requests?

Short answer

UDP flood is an attack that consumes the bandwidth and the packet processing capacity of the target by sending UDP packets, which do not require establishing a connection, at a high rate (RFC 4732). In TR7, the UDP Flood box in the UDP band of the L4 DDoS Management screen carries two rules: UDP Flood: New-UDP Rate limits the number of new UDP packets per second per source (default 500/s), and DNS Flood limits the number of DNS requests per second per source (default 200/s); the default mode of both is Monitor, and both are applied to the traffic passing through the device in addition to the traffic directed to the device. The reason DNS has a separate rule is that a small query can produce a much larger response: DNS can be both a flood target and the tool of a reflection & amplification attack. The separate rule limits DNS requests independently of the other UDP traffic and with a lower ceiling.

Where It Is Used in TR7

Where	Field / label	What for
Left Monitor Panel → Route Tables & L4 DDoS → route table → L4 DDoS Management → UDP	UDP Flood box; the pencil icon on the rule row → Status and Limit per Second	The UDP packet and DNS request limit per source
L4 DDoS Management → UDP	UDP Signatures box	Dropping known UDP attack signatures (Zero-byte UDP, SMBnuke)
Left Monitor Panel → Route Tables & L4 DDoS → route table → Dashboard	Floods tab	Chart of the UDP and DNS rate per source together with the limit

• The use of DNS as an attack tool: What is a Reflection & Amplification attack; how does the TR7 device protect against this attack?

Common Misconceptions

• "UDP flood affects only DNS servers." All UDP services and the bandwidth of the line can be targets; UDP Flood: New-UDP Rate looks at all UDP traffic, and DNS merely gets a separate ceiling.
• "The DNS limit is part of the general UDP limit." DNS Flood is a separate rule that counts only the traffic directed to DNS, and it carries its own limit.
• "The limits drop packets by default." The default value of both rules is Monitor; in this mode, the rules measure and chart the rate per source. To drop packets, the Status field of the rule is set to Block or Quarantine.

How it is done in the documentation

• UDP Flood · What Is UDP Flood?
• UDP Flood · DNS Flood
• UDP · Rule Modes

Related questions

• What is a Reflection & Amplification attack; how does the TR7 device protect against this attack?
• What is a SYN Flood attack; which rules does TR7 apply against it?
• What is the difference between L4 DDoS Protection and L7 DDoS Protection?