How is a UDP flood different from a reflection attack?

Reflection borrows someone else's bandwidth and hides the origin; a direct UDP flood does neither. The attacker sends the packets themselves, which means they need capacity proportional to the damage and their sources may be traceable. It is a cruder attack and correspondingly easier to attribute.

Can we just block UDP?

For ports where nothing listens, yes, and it is worth doing at the edge because it costs nothing. For ports carrying real service — DNS, VPN, video, VoIP — blocking the protocol removes the attack and the service together, which is why the useful rule is narrow rather than protocol-wide.

Why does packet size matter so much here?

Because a flood of small packets exhausts packet-processing budget long before it fills the stated bandwidth. A device rated at 10 Gbps may be handling only a fraction of that in bits while already at its packet-rate ceiling — which is what the capacity planner converts between.

Attack class

UDP Flood

Last updated: August 2026 · Volume without leverage · Reading time ~8 min

Gates narrowed against a broad inbound flow, standing for volume that has to be stopped before it reaches the circuit it would otherwise fill.

A UDP flood sends traffic directly at a target with no reflection and no amplification, consuming bandwidth and packet-processing budget. Because it has no leverage, the attacker needs real capacity of their own — and because it needs no forged source, the addresses are sometimes genuine, which changes what responses are available.

Network topology showing where a volumetric flood does its damage: the marker sits on the link between the internet and the ISP edge router, before any equipment the buyer owns. — Sharp version (SVG)

What it exhausts

Bandwidth first, packet-processing budget close behind. Nothing subtle happens: packets arrive faster than the path can carry or the receiver can handle, and everything sharing that path degrades with the target.

How it differs from similar attacks

Reflection and amplification achieve the same result with far less attacker bandwidth by borrowing third-party servers. A direct flood has no such leverage, which means it takes a real botnet or real capacity to produce a serious one.

The compensating property, from the defender’s point of view, is that the sources may be genuine. Reflection forces you to treat every source as forged; a direct flood sometimes leaves addresses worth acting on, which makes source-based responses viable in a way they usually are not.

Observable telemetry

Packet rate rising sharply, with bit rate rising in proportion or lagging behind it.
Traffic to UDP ports where nothing is listening — often the clearest single signal.
Packet-size distribution clustered at a single value, because generators tend to produce one.
ICMP port-unreachable responses leaving your network in volume, which is your own host answering the flood and consuming resources doing it.

Common false positives

Legitimate UDP-heavy services — video, VoIP, gaming, VPN concentrators, authoritative DNS — produce sustained high-rate UDP that resembles a flood in every aggregate metric. The distinguishing question is whether the traffic maps to sessions or requests you can account for.

Backup and replication windows are a recurring cause of nightly false alarms on thresholds that were set during the day.

Mitigation by layer

Upstream. This is where the class is answered. FlowSpec can drop a protocol-and-port combination precisely; RTBH is the blunt fallback; scrubbing absorbs it at scale.

Your edge. Drop UDP to ports nothing listens on, and rate-limit the rest against measured normal. Cheap, and removes a meaningful share.

Host. Ensure the kernel is not spending its budget generating ICMP unreachables for every discarded packet — a detail covered in the Linux network stack tuning guide.

Operational pitfalls

Blocking the protocol wholesale. The most common self-inflicted outage in this class: a rule that drops all UDP takes DNS resolution with it.

Sizing the response in gigabits. A small-packet flood reaches a device’s packet-rate ceiling far below its bit-rate rating; the capacity planner converts between the two.

Assuming sources are forged. Sometimes they are not, and checking is worth the minute it takes.

Safe validation

Against your own infrastructure with authorisation, staying deliberately below saturation so the test measures the device rather than the uplink. Record the packet rate at which behaviour changes rather than the bit rate, and run the same test at several frame sizes.

Sources

Frequently asked questions

How is a UDP flood different from a reflection attack?: Reflection borrows someone else's bandwidth and hides the origin; a direct UDP flood does neither. The attacker sends the packets themselves, which means they need capacity proportional to the damage and their sources may be traceable. It is a cruder attack and correspondingly easier to attribute.
Can we just block UDP?: For ports where nothing listens, yes, and it is worth doing at the edge because it costs nothing. For ports carrying real service — DNS, VPN, video, VoIP — blocking the protocol removes the attack and the service together, which is why the useful rule is narrow rather than protocol-wide.
Why does packet size matter so much here?: Because a flood of small packets exhausts packet-processing budget long before it fills the stated bandwidth. A device rated at 10 Gbps may be handling only a fraction of that in bits while already at its packet-rate ceiling — which is what the capacity planner converts between.

Published: August 2026 · Last reviewed: August 2026

Reviewed means the sources above were re-read on that date; the text is only reissued when something material changed.

This guide is updated as vendors release new models and pricing. How we compare vendors