"Anomalies" udp_flood

[wotik]

Hello everyone

I turned on the IPv4 DoS Policy module on my 60F a few weeks ago. So far, I have created one "monitoring" policy only for packet flows above certain thresholds (other than the factory ones, of course).

At the beginning, I gave some small thresholds and I try to observe it all, possibly increasing the counter thresholds if I see when some desired service exceeds them.

Sometimes the "test" policy catches an "anomaly" udp_flood from IP addresses 46.134.193.80, 142.250.186.194 or 173.194.164.202 (Google) having counters at the level of counters for sources with real threats. I don't really know what could be the cause of such behavior... I don't think there are any real "attacks" either. Maybe some hints? Below are two sample logs.

Do you also use DoS Policy? What meter thresholds do you use for a small network of ~20-25 computers? I know that this is an individual approach for each case, but maybe at least some indicative range as it is with you.

date=2023-02-28 time=08:03:06 eventtime=1677567786873677059 tz="+0100" logid="0720018432" type="utm" subtype="anomaly" eventtype="anomaly" level="alert" vd="root" severity="critical" srcip=142.250.186.194 srccountry="Poland" dstip=MAIN_IP_WAN dstcountry="Poland" srcintf="wan2" srcintfrole="wan" sessionid=0 action="detected" proto=17 service="udp/60942" count=277 attack="udp_flood" srcport=443 dstport=60942 attackid=285212772 policyid=3 policytype="DoS-policy" ref="http://www.fortinet.com/ids/VID285212772" msg="anomaly: udp_flood, 61 > threshold 60, repeats 277 times since last log, pps 34 of prior second" crscore=50 craction=4096 crlevel="critical"

date=2023-02-28 time=05:55:10 eventtime=1677560110633312339 tz="+0100" logid="0720018432" type="utm" subtype="anomaly" eventtype="anomaly" level="alert" vd="root" severity="critical" srcip=173.194.164.202 srccountry="Poland" dstip=MAIN_IP_WAN dstcountry="Poland" srcintf="wan2" srcintfrole="wan" sessionid=0 action="detected" proto=17 service="udp/53399" count=22 attack="udp_flood" srcport=443 dstport=53399 attackid=285212772 policyid=3 policytype="DoS-policy" ref="http://www.fortinet.com/ids/VID285212772" msg="anomaly: udp_flood, 61 > threshold 60, repeats 22 times since last log" crscore=50 craction=4096 crlevel="critical"

[srajeswaran]

Hi Wojtek,

For DOS policies there is no general thresholds values as it is completely depending upon the traffic pattern on your network. What you are doing is the right approach, configuring a DOS policy as monitoring with a lower threshold value.

As per the logs, the traffic is UDP on port 443 (Source), which is not very common. Can you verify if there is actually a session originated from your LAN towards any of these public IPs on UDP port 443 and make sure they are genuine traffic. I see this port is used by gaming sites, please check if the traffic is some kind of reply packet for a session originated from your LAN. If there is a valid session from your LAN towards these IPs, I think we can consider these are non "attack" and you may need to increase the threshold (may be double it ) and monitor.

[wotik]

@srajeswaran - I analyzed this and similar network traffic as you suggested and I can see some dependence.

It seems to me that every "suspicious response" of the udp_flood type from a given external IP address, i.e.:

adom_oid=3 itime=1677716210 loguid=7205736253919068214 epid=101 euid=3 data_parsername="FortiGate Log Parser v2" data_sourceid="FGT60FXXX" data_sourcename="NAME root" data_sourcetype="FortiGate" data_timestamp="1677716210" app_service="udp/51602" dst_geo="Poland" dst_ip="MY_IP_WAN" dst_port=51602 event_action="detected" event_id=18432 event_message="anomaly: udp_flood, 81 > threshold 80, repeats 368 times since last log, pps 3 of prior second" event_severity="alert" event_subtype="anomaly" event_type="utm" host_ip="66.102.1.155" host_location="Belgium" net_proto="17" net_sessionid="0" src_geo="Belgium" src_intf="wan2(wan)" src_ip="66.102.1.155" src_port=443 threat_action="detected" threat_id="285212772" threat_name="udp_flood" threat_pattern="udp_flood" threat_ref="http://www.fortinet.com/ids/VID285212772" threat_severity="high" threat_type="Reconnaissance"

is always preceded by traffic from my network towards this IP address, e.g.:

adom_oid=3 itime=1677716210 loguid=7205736253919068212 epid=1031 euid=3 data_parsername="FortiGate Log Parser v2" data_sourceid="FGT60FTXXX" data_sourcename="NAME root" data_sourcetype="FortiGate" data_timestamp="1677716210" app_cat="Network.Service" app_id=40169 app_name="QUIC" app_service="HTTPS" dst_domain="stats.g.doubleclick.net" dst_geo="Belgium" dst_intf="wan2(wan)" dst_ip="66.102.1.155" dst_port=443 event_action="pass" event_id=28704 event_message="Network.Service: QUIC" event_profile="_standardowyAPP" event_severity="information" event_subtype="app-ctrl" event_type="utm" host_ip="MY_HOST_LAN" host_location="Reserved" net_proto="17" net_sessionid="2640773" src_geo="Reserved" src_intf="internal(lan)" src_ip="MY_HOST_LAN" src_port=51602

Same ports, same protocol, same time.

What do you think?

[srajeswaran · Accepted solution]

This looks normal traffic, we may go ahead and increase the threshold. The system is using QUIC thats why we see UDP 443 (which is expected).

[wotik]

Hi @srajeswaran 

I also associated it with QUIC and UDP/443 but I wanted to make sure... ;)

[WSSE_IT]

I have a similar situation, but in my case it coincided with updating to version 7.4.2. After updating, I receive a lot of udp_flood notifications from Google, Microsoft, etc.