The following are UDP Attacks Signatures
- 4002—UDP flood (severity 1, DoS):
This is triggered when a large number of UDP packets are directed
at a host. This will fire when the Pepsi attack is launched across
a protected boundary. This signature is also indicative of a UDP
port sweep.
- 4050—UDP Bomb (severity 3,
DoS): This signature is triggered when the UDP length specified is
less than the IP length specified. This malformed packet type is
associated with a DoS attempt.
- 4051—Snork (severity 3, DoS):
This signature is triggered when a UDP packet is seen with a
source port of either 135, 7, or 19 and a destination port of 135
is detected.
- 4052—Chargen DoS (severity 3, DoS):
This signature is triggered when a UDP packet is detected with a
source port of 7 and a destination port of 19.
|
|
