Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
wotik
New Contributor III

"Anomalies" udp_flood

Hello everyone

 

I turned on the IPv4 DoS Policy module on my 60F a few weeks ago. So far, I have created one "monitoring" policy only for packet flows above certain thresholds (other than the factory ones, of course).

At the beginning, I gave some small thresholds and I try to observe it all, possibly increasing the counter thresholds if I see when some desired service exceeds them.

 

Sometimes the "test" policy catches an "anomaly" udp_flood from IP addresses 46.134.193.80, 142.250.186.194 or 173.194.164.202 (Google) having counters at the level of counters for sources with real threats. I don't really know what could be the cause of such behavior... I don't think there are any real "attacks" either. Maybe some hints? Below are two sample logs.

 

Do you also use DoS Policy? What meter thresholds do you use for a small network of ~20-25 computers? I know that this is an individual approach for each case, but maybe at least some indicative range as it is with you.

 

date=2023-02-28 time=08:03:06 eventtime=1677567786873677059 tz="+0100" logid="0720018432" type="utm" subtype="anomaly" eventtype="anomaly" level="alert" vd="root" severity="critical" srcip=142.250.186.194 srccountry="Poland" dstip=MAIN_IP_WAN dstcountry="Poland" srcintf="wan2" srcintfrole="wan" sessionid=0 action="detected" proto=17 service="udp/60942" count=277 attack="udp_flood" srcport=443 dstport=60942 attackid=285212772 policyid=3 policytype="DoS-policy" ref="http://www.fortinet.com/ids/VID285212772" msg="anomaly: udp_flood, 61 > threshold 60, repeats 277 times since last log, pps 34 of prior second" crscore=50 craction=4096 crlevel="critical"

 

date=2023-02-28 time=05:55:10 eventtime=1677560110633312339 tz="+0100" logid="0720018432" type="utm" subtype="anomaly" eventtype="anomaly" level="alert" vd="root" severity="critical" srcip=173.194.164.202 srccountry="Poland" dstip=MAIN_IP_WAN dstcountry="Poland" srcintf="wan2" srcintfrole="wan" sessionid=0 action="detected" proto=17 service="udp/53399" count=22 attack="udp_flood" srcport=443 dstport=53399 attackid=285212772 policyid=3 policytype="DoS-policy" ref="http://www.fortinet.com/ids/VID285212772" msg="anomaly: udp_flood, 61 > threshold 60, repeats 22 times since last log" crscore=50 craction=4096 crlevel="critical"

Best Regards,
Wojtek
Best Regards,Wojtek
1 Solution
srajeswaran
Staff
Staff

This looks normal traffic, we may go ahead and increase the threshold. The system is using QUIC thats why we see UDP 443 (which is expected).

Regards,

Suraj

- Have you found a solution? Then give your helper a "Kudos" and mark the solution.

View solution in original post

5 REPLIES 5
srajeswaran
Staff
Staff

Hi Wojtek,

 

For DOS policies there is no general thresholds values as it is completely depending upon the traffic pattern on your network. What you are doing is the right approach, configuring a DOS policy as monitoring with a lower threshold value.

 

As per the logs, the traffic is UDP on port 443 (Source), which is not very common. Can you verify if there is actually a session originated from your LAN towards any of these public IPs on UDP port 443 and make sure they are genuine traffic. I see this port is used by gaming sites, please check if the traffic is some kind of reply packet for a session originated from your LAN. If there is a valid session from your LAN towards these IPs, I think we can consider these are non "attack" and you may need to increase the threshold (may be double it ) and monitor.

Regards,

Suraj

- Have you found a solution? Then give your helper a "Kudos" and mark the solution.

wotik
New Contributor III

@srajeswaran - I analyzed this and similar network traffic as you suggested and I can see some dependence.

 

It seems to me that every "suspicious response" of the udp_flood type from a given external IP address, i.e.:

 

adom_oid=3 itime=1677716210 loguid=7205736253919068214 epid=101 euid=3 data_parsername="FortiGate Log Parser v2" data_sourceid="FGT60FXXX" data_sourcename="NAME root" data_sourcetype="FortiGate" data_timestamp="1677716210" app_service="udp/51602" dst_geo="Poland" dst_ip="MY_IP_WAN" dst_port=51602 event_action="detected" event_id=18432 event_message="anomaly: udp_flood, 81 > threshold 80, repeats 368 times since last log, pps 3 of prior second" event_severity="alert" event_subtype="anomaly" event_type="utm" host_ip="66.102.1.155" host_location="Belgium" net_proto="17" net_sessionid="0" src_geo="Belgium" src_intf="wan2(wan)" src_ip="66.102.1.155" src_port=443 threat_action="detected" threat_id="285212772" threat_name="udp_flood" threat_pattern="udp_flood" threat_ref="http://www.fortinet.com/ids/VID285212772" threat_severity="high" threat_type="Reconnaissance"

 

is always preceded by traffic from my network towards this IP address, e.g.:

 

adom_oid=3 itime=1677716210 loguid=7205736253919068212 epid=1031 euid=3 data_parsername="FortiGate Log Parser v2" data_sourceid="FGT60FTXXX" data_sourcename="NAME root" data_sourcetype="FortiGate" data_timestamp="1677716210" app_cat="Network.Service" app_id=40169 app_name="QUIC" app_service="HTTPS" dst_domain="stats.g.doubleclick.net" dst_geo="Belgium" dst_intf="wan2(wan)" dst_ip="66.102.1.155" dst_port=443 event_action="pass" event_id=28704 event_message="Network.Service: QUIC" event_profile="_standardowyAPP" event_severity="information" event_subtype="app-ctrl" event_type="utm" host_ip="MY_HOST_LAN" host_location="Reserved" net_proto="17" net_sessionid="2640773" src_geo="Reserved" src_intf="internal(lan)" src_ip="MY_HOST_LAN" src_port=51602

 

Same ports, same protocol, same time.

 

What do you think?

Best Regards,
Wojtek
Best Regards,Wojtek
srajeswaran
Staff
Staff

This looks normal traffic, we may go ahead and increase the threshold. The system is using QUIC thats why we see UDP 443 (which is expected).

Regards,

Suraj

- Have you found a solution? Then give your helper a "Kudos" and mark the solution.

wotik
New Contributor III

Hi @srajeswaran 

 

I also associated it with QUIC and UDP/443 but I wanted to make sure... ;)

Best Regards,
Wojtek
Best Regards,Wojtek
WSSE_IT
New Contributor

I have a similar situation, but in my case it coincided with updating to version 7.4.2. After updating, I receive a lot of udp_flood notifications from Google, Microsoft, etc.

Top Kudoed Authors