Why is there a lot of udp flood in Google IP?

[dwlee]

Hi guys, We manage customers who use FortiGate.

Same for all customers using DoS Policy, There are a lot of udp floods from the source Google IP. The source port is UDP 443 and the destination is UDP 30000 or higher random port.

The detected source IP is always as follows. This is Google IP. 34.64.0.0/10 59.0.0.0/11 64.233.160.0/19 74.125.0.0/16 172.217.0.0/16 173.194.0.0/16 209.85.128.0/17 216.58.192.0/19

Is this a DRDoS attack? Or is it a false positive by the Google QUIC protocol? Would it be a problem if I created an exception policy for Google IP?

thank you very much for your feedback.

[emnoc]

if it's udp, it might be forged or spoof. I would not made an exception unless your sure it's legit.

just my observation.

Ken Felix