Skip to main content
dwlee
New Member
November 10, 2020
Question

Why is there a lot of udp flood in Google IP?

  • November 10, 2020
  • 1 reply
  • 4290 views

Hi guys, We manage customers who use FortiGate.

 

Same for all customers using DoS Policy, There are a lot of udp floods from the source Google IP. The source port is UDP 443 and the destination is UDP 30000 or higher random port.

 

The detected source IP is always as follows. This is Google IP. 34.64.0.0/10 59.0.0.0/11 64.233.160.0/19 74.125.0.0/16 172.217.0.0/16 173.194.0.0/16 209.85.128.0/17 216.58.192.0/19

 

Is this a DRDoS attack? Or is it a false positive by the Google QUIC protocol? Would it be a problem if I created an exception policy for Google IP?

 

thank you very much for your feedback.

1 reply

emnoc
New Member
November 10, 2020

if it's udp, it might be forged or spoof. I would not made an exception unless your sure it's legit.

 

just my observation.

 

Ken Felix

Thought Leadership. Security Summit. Thursday, November 12th, PGA National Resort, Palm Beach Gardens, FL.
Thought Leadership. Security Summit. Thursday, October 8th. Disney's Grand Californian Hotel & SPA, Anaheim, CA.