UDP Explained: Connectionless Datagrams & Amplification Attacks (Animated)

UDP (User Datagram Protocol) is the simple, fast alternative to TCP. It sends each message as a separate datagram with no handshake, no acknowledgements and no retransmission. That makes it ideal for games, voice and video calls, DNS and streaming, and also easy to abuse, because the sender address can be forged.

1. Just send it: no handshake at all

TCP needs three packets before any data moves. UDP needs zero: the first packet already carries data. The header is only 8 bytes: source port, destination port, length and checksum.

1. UDP (Your laptop → Game server): The very first packet already carries data. Notice what is missing compared with TCP: no sequence number, no ACK number, no flags.
2. UDP (Game server → Your laptop): The server answers the same way. Neither side keeps any “connection”; each datagram stands alone.

Wireshark filter:

udp

2. A packet is lost: nobody notices, nobody resends

The server streams updates. One datagram is lost. With UDP there is no ACK, so the sender never finds out and nothing is resent.

1. UDP (Game server → Your laptop): Update 1 arrives.
2. UDP (Game server → Your laptop): Update 2 is lost. No duplicate ACK, no retransmission: UDP does not even know.
3. UDP (Game server → Your laptop): Update 3 arrives and the game simply carries on. Fresh data matters more than old data, which is exactly why real-time apps choose UDP.

Wireshark filter:

udp.port == 27015

3. Amplification attack: attack: small fake question, huge answer to the victim

Because there is no handshake, an attacker can forge the source IP. They send small questions to open servers while pretending to be the victim, and the servers send large answers to the victim.

1. DNS QUERY (Attacker → Open DNS servers): The attacker sends 64-byte questions with the victim’s address as the sender. Nothing in UDP checks this.
2. DNS ANSWER (Open DNS servers → Your laptop): Each server replies to the “sender”, the victim, with an answer about 50 times larger. Thousands of servers doing this knock the victim offline: a DDoS.

Wireshark filter:

udp.srcport == 53 && udp.length > 1000

4. Defences: defence: stop forged packets and open servers

Three layers: ISPs drop packets with forged source addresses (BCP 38), server owners close open resolvers and rate-limit responses, and victims use DDoS scrubbing services.

1. DNS QUERY (Attacker → Open DNS servers): The servers now answer only their own customers and limit repeated responses, so the forged questions are dropped.

Test your server:

dig +short test.openresolver.com TXT @your.server.ip

FAQ