UDP

4.8 Interpret the fields in protocol headers as related to intrusion analysis

📘Cisco Certified CyberOps Associate (200-201 CBROPS)

---

1. What is UDP?

UDP, or User Datagram Protocol, is one of the main protocols in the Transport Layer of the TCP/IP model. Unlike TCP, UDP is connectionless, which means:

• It does not establish a session before sending data.
• It does not guarantee delivery, ordering, or error correction.
• It is faster and used in situations where speed matters more than reliability.

Common IT uses of UDP:

• DNS (Domain Name System) queries – resolving domain names to IP addresses.
• DHCP (Dynamic Host Configuration Protocol) – assigning IP addresses to devices.
• VoIP (Voice over IP) and video conferencing – low latency is crucial.
• Streaming media – continuous flow of data without retransmission delays.

---

2. UDP Header Structure

A UDP header is very simple: it is only 8 bytes long. This is important because fewer fields mean less overhead, making UDP fast but less reliable.

The UDP header contains four fields:

Field	Size	Purpose
Source Port	16 bits	The port number of the sending application.
Destination Port	16 bits	The port number of the receiving application.
Length	16 bits	Total length of the UDP datagram (header + data).
Checksum	16 bits	Used to verify data integrity. Optional in IPv4, required in IPv6.

Let’s explain each field in detail.

---

2.1 Source Port

• Definition: Identifies the sending application on the host.
• Example in IT environments:
  • A DNS server sending a response back to a client. The source port could be 53, which is the standard port for DNS.
• Intrusion analysis relevance:
  • Unexpected source ports can indicate malicious activity. For example, a response claiming to be from a DNS server on a non-standard port might be suspicious.

---

2.2 Destination Port

• Definition: Identifies the receiving application on the destination host.
• Example in IT environments:
  • DHCP client listens on port 68, so a DHCP server will send responses to this port.
• Intrusion analysis relevance:
  • Attackers may use well-known service ports to hide malicious traffic. Monitoring unusual destination ports can help detect threats like data exfiltration or unauthorized services.

---

2.3 Length

• Definition: Total length of the UDP packet (header + payload) in bytes.
• Important points for exam:
  • Minimum length is 8 bytes (header only, no data).
  • Maximum length is 65,535 bytes.
• Intrusion analysis relevance:
  • Unusually large or small packets can indicate an attack. For example:
    • Very small packets may be part of a UDP scan.
    • Very large packets could indicate an amplification attack (like DNS amplification DDoS).

---

2.4 Checksum

• Definition: Provides error detection for the header and payload.
• Important points:
  • Optional in IPv4 (if set to 0, it is ignored).
  • Mandatory in IPv6.
• Intrusion analysis relevance:
  • If the checksum is incorrect, the packet may be corrupted or deliberately crafted.
  • Attackers sometimes manipulate the checksum to evade detection or testing network behavior.

---

3. UDP in Intrusion Analysis

Understanding UDP is important for analyzing network traffic and spotting intrusions:

1. No handshake: UDP doesn’t establish a session. Intruders can exploit this to send spoofed packets without being traced.
2. High volume attacks: Because UDP is connectionless, attackers often use it for flood attacks.
3. Protocol misuse detection: Certain ports are associated with services (e.g., DNS: 53, NTP: 123, SNMP: 161). Traffic to unusual ports might indicate malware or unauthorized services.
4. Packet analysis: Tools like Wireshark allow you to inspect:
   • Source and destination ports
   • Length of UDP datagrams
   • Payload data (to detect suspicious commands or data)

---

4. Example Scenario in an IT Environment

Imagine a company network:

• A client sends a DNS request from port 49152 (ephemeral port) to a DNS server at port 53.
• The server responds back to port 49152 with the IP address of the requested domain.
• During intrusion analysis, you notice:
  • Multiple responses from port 53 to unusual destination ports.
  • Large UDP packets with invalid checksums.

This could indicate DNS amplification attacks or spoofed traffic—classic intrusion signs.

---

5. Summary for Exam

Key points to remember for the Cisco CyberOps exam:

1. UDP is connectionless, fast, but unreliable.
2. UDP header is 8 bytes with four fields: Source Port, Destination Port, Length, Checksum.
3. Source and destination ports identify applications.
4. Length shows total datagram size.
5. Checksum helps verify integrity.
6. In intrusion analysis, look for unusual ports, invalid checksums, and abnormal packet sizes.
7. Common UDP services: DNS, DHCP, SNMP, NTP, VoIP.