UDP, the User Datagram Protocol, sends self-contained messages called datagrams over IP with no handshake, no ordering and no delivery guarantee. That makes it fast and light, and it is why spoofed-source reflection attacks are possible. TCP is the alternative when you need ordered, reliable delivery.
What does RFC 768 say?
RFC 768, written by Jon Postel in 1980, defines UDP in about three pages. It says the protocol gives application programs a way to send messages with a minimum of protocol mechanism, is transaction oriented, and that delivery and duplicate protection are not guaranteed. Applications that need ordered, reliable streams should use TCP. The RFC names its main uses as the Internet Name Server (what became DNS) and Trivial File Transfer.
The header has four fields: source port, destination port, length and checksum. The length is the size in octets of the header plus the data, so the minimum is eight. Source port is optional and may be zero. A checksum of zero means the sender did not compute one. UDP runs as IP protocol number 17.
That is the whole protocol. Everything else, such as retransmission, ordering or encryption, is the application's job.
Why use it at all?
No connection setup means one request can get one answer in one round trip. DNS, time sync, streaming media, voice, games and many discovery protocols suit that model. Losing one packet of a live call is better than stalling the call to resend it.
Constructed example: a game server sends player positions twenty times per second. A lost update is replaced by the next one 50 milliseconds later. Resending the old position would only add delay.
What are the security consequences?
Because UDP has no handshake, the receiver cannot confirm the sender's address before replying. CISA's alert on UDP-based amplification attacks explains the result. An attacker can easily forge the source address of a UDP datagram. If many datagrams carry the victim's address as the source, the server answers the victim instead of the attacker. That is a reflected denial of service.
Amplification makes it worse. Some UDP protocol commands produce responses much larger than the request, and CISA says a single packet can generate between 10 and 100 times the original bandwidth. CISA lists protocols with this property, including DNS, NTP, CLDAP, SSDP, SNMPv2, Memcached and others. Combine reflection, amplification and many public servers, and a small attacker can flood a large target.
How do you defend?
CISA suggests victims watch for abnormally large responses toward an address, detect large UDP packets to higher-order ports and non-stateful UDP, and use stateful UDP inspection such as reflexive access control lists at border firewalls and routers. Service operators and internet providers should use network flow data to detect spoofed packets and unusual request volumes to at-risk UDP services, so they do not become amplifiers.
For your own services, the advice is simple: do not expose UDP services you do not need, restrict those you do, and do not run open resolvers or other open reflectors.
How to check or apply this
- List every UDP port your internet-facing hosts answer on. Scan from outside, since firewalls change.
- Close services you do not need. Legacy ones such as CharGEN and QOTD have no business on the internet.
- Restrict DNS and NTP servers to the clients they should serve.
- Enable egress filtering so your network does not emit packets with forged source addresses.
- Monitor flow data for large UDP responses and unusual request spikes.
- Plan for volumetric attack response with your provider before one arrives.
- When you build on UDP, add what it lacks: authentication, replay protection, and rate limits.
Quick check
Is UDP less secure than TCP?
It provides fewer built-in protections, such as no handshake or ordering. Security properties like encryption and authentication have to come from the application or a layer above.
Why can UDP be used for reflection attacks?
Source addresses can be forged and there is no handshake to check them, so a server may send its reply to a victim who never asked.
Sources
Last reviewed: 18 October 2026.
